---
id: CVE-2026-91417
title: 'openjdk: Enhance CORBA (Oracle CPU 2026-10) (CVE-2026-91417)'
summary: >-
  A flaw was found in the Common Object Request Broker Architecture (CORBA)
  component of OpenJDK. An unauthenticated remote attacker could exploit this
  flaw by sending specially crafted data to exposed application programming
  interfaces (API…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: vendor
cwe: CWE-770
vendor: Red Hat
product: Red Hat Enterprise Linux 7
affected:
  - build_of_openjdk 1.8
  - enterprise_linux 6
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
published: '2026-10-20'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T22:00:43+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91417.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91417.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-91417'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2557953'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-91417'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91417'
  - url: 'https://www.oracle.com/security-alerts/cpuoct2026.html'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00306
epssPercentile: 0.23276
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-22T18:42:52.658878Z'
ingestedAt: '2026-10-20T22:23:33.762Z'
---

## Overview

A flaw was found in the Common Object Request Broker Architecture (CORBA) component of OpenJDK. An unauthenticated remote attacker could exploit this flaw by sending specially crafted data to exposed application programming interfaces (APIs) over the network. A successful attack can result in a partial Denial of Service (DoS), degrading application availability.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat build of OpenJDK 1.8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat build of OpenJDK 1.8, Red Hat Enterprise Linux 8, … · updated 2026-10-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-91417.json)

**openjdk: Enhance CORBA (Oracle CPU 2026-10)** — rated Moderate by Red Hat. Released 2026-10-20, updated 2026-10-22.

Affected:

- Red Hat build of OpenJDK 1.8
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

No fix planned:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat build of OpenJDK 1.8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9

Not affected:

- Red Hat build of OpenJDK 11 ELS
- Red Hat build of OpenJDK 17
- Red Hat build of OpenJDK 21
- Red Hat build of OpenJDK 25
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images

## Remediation

Out of support scope