KB-SEC-2026-1028-03_CVE-2026-91403

WinMagic

Security Advisory

CVE-2026-91403 — Oracle Java SE / GraalVM JSSE Remote Code Execution Vulnerability

Reference: KB-SEC-2026-1028-03    |    Published: October 28, 2026    |    Status: Not Affected

Applies to: SecureDoc Client, SES Console, SESWeb (all versions)

Third-party component affected: Oracle Java    |    Severity: Critical

Executive summary

WinMagic is aware of CVE-2026-91403 (Oracle Java SE / GraalVM JSSE Remote Code Execution Vulnerability), a vulnerability affecting Oracle Java. WinMagic has reviewed this CVE against SecureDoc Client, the SES Console and SESWeb. None of these products is affected, for the reason given below. No remediation, patch, or configuration change is required in response to this CVE.

Vulnerability details

What the vulnerability is

A critical flaw exists in the Java Secure Socket Extension (JSSE) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Oracle disclosed the vulnerability in an out-of-band security advisory on October 21, 2026, without publishing the full technical root cause or exploitation sequence.

Why you should pay attention

The vulnerability is exploitable remotely over a network, without authentication or user interaction, and over multiple protocols that use JSSE. Oracle rates both the confidentiality and integrity impact as high: a successful attack could expose sensitive application data or allow unauthorized creation, modification, or deletion of data the Java runtime can access, while the server keeps running normally, which means the absence of a crash or outage is not a reliable sign that a system is unaffected. Because Java underpins a large share of enterprise web services, backends, middleware, and APIs, the practical exposure is broad wherever Java handles attacker-reachable network input. Oracle also notes that unsupported, older Java versions were not tested but may share the same defect.

WinMagic product assessment

SecureDoc Client, SES Console, and SESWeb

SecureDoc does not include, install or depend on Oracle Java SE or any other Java runtime.

Conclusion: SecureDoc Client, the SES Console and SESWeb are not affected by CVE-2026-91403.

Remediation

No WinMagic product-specific remediation, software update, patch, or configuration change is required in response to CVE-2026-91403. Organizations that run Oracle Java elsewhere in their own environment, outside of WinMagic products, should apply that vendor's own patch according to their standard process.

Ongoing monitoring

WinMagic continues to monitor relevant security advisories and available information concerning CVE-2026-91403. Should new information materially change this assessment, WinMagic will review its potential impact on SecureDoc Client, the SES Console or SESWeb and update this article accordingly.

Questions about this advisory

Customers with questions about this assessment can contact WinMagic Support through the usual support channel referencing KB-SEC-2026-1028-03.

WinMagic Corp.

winmagic.com