As reported here:
http://mail.openjdk.java.net/pipermail/jdk9-dev/2016-November/005171.html

The use JAX-WS implementation uses the JAXP CatalogManager API to get the system catalog but it has insufficient permissions to this this and so fails. This code is currently being changed to use the new XML Catalog API and so testing should be done with a security manager to see if the same issue arises.

Note that this issue could potentially be a JAXP issue, maybe the JAXP code is missing a doPrivileged block to obtain the system catalog without needing the caller to have the permissions. Also note that this is a regression in JDK 9, the issue does not happen with JDK 8.