Java has a 9.1 split loophole, CVE-2026-91403, but I looked around the Oracle bulletin and found two big holes.
It's not in the CPU this season, and there's no RCE for that 9.1 cent. The three layers of Oracle ' s bulletin system, CVSS vector, supply chain are to be detached, so the problem is not in itself.

