Oracle Java SE and Oracle GraalVM CVE-2026-91403

[GiorgioM]

Hi All,

The Customer has asked me for information regarding the release by HCL-BigFix of fixlets for CVE-2026-91403, which was published by Oracle on October 21, 2026. This is a critical vulnerability (CVSS 9.1) affecting Oracle Java SE and Oracle GraalVM.
https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
Does anyone have any news on this?
Is the HCL-BigFix development team already working on it?
Thanks.

Giorgio

[dmccalla]

The JRE update was released yesterday and in fact updated once Oracle changed the file. We do not currently support Oracle GraalVM. I recommend checking the releases page for up to the minute info.

Content Modification: Updates for Windows Applications published 2026-10-21

BigFix has modified content in the Updates for Windows Applications site. New: 14012507 Google Chrome 156.0.8078.48 Available 7051675 Java Runtime Environment 8 update 511 Available (JRE 8 Installed) - CPU 7051677 Java Runtime Environment 8 update 511 Available (JRE < 8 Installed) - CPU 7051679 Java Runtime Environment 8 update 511 Available - CPU - CORRUPT PATCH 7057235 Java Runtime Environment 8 update 511 (32-bit) Available (x64) - CPU - CORRUPT PATCH 7057237 Java Runtime Environment 8 upd…

[ageorgiev]

How about the Oracle Java SE that are part of the Extended sites?

and in fact, on Windows there is still no support for v25 which is LTS.