CVE-2026-87291 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Networking component of Oracle Java SE, specifically affecting versions 21.0.12.1, 25.0.4.1, and version 27. This flaw represents a significant security risk as it permits an unauthenticated attacker to compromise the integrity of the Java runtime environment through network-based interactions. The attack vector is classified as remote with low complexity, indicating that no special conditions or user interaction are required for exploitation beyond establishing network connectivity via multiple supported protocols. The primary consequence of this vulnerability is unauthorized read access to a subset of data accessible by Oracle Java SE, which directly impacts the confidentiality aspect of security without necessarily affecting integrity or availability in the immediate scope of this specific flaw.
From a technical perspective, the root cause aligns with CWE-200, an Information Exposure vulnerability, where sensitive information is inadvertently disclosed to unauthorized actors. The exploitation mechanism requires the attacker to supply malicious data directly to APIs within the affected Networking component. It is critical to note that this vulnerability cannot be exploited through traditional untrusted Java Web Start applications or untrusted Java applets due to their sandboxing mechanisms and security restrictions. Instead, the attack surface is limited to scenarios where an external entity can interact with these specific APIs over a network, such as through web services or other remote procedure call mechanisms. This distinction narrows the potential threat landscape but does not eliminate it, particularly for applications that expose internal Java networking interfaces to untrusted networks or public-facing endpoints without adequate input validation and access controls.
The operational impact of this vulnerability centers on data confidentiality breaches. An attacker who successfully exploits this flaw can extract sensitive information stored within the context of the running Java application. Depending on the specific implementation, this could include configuration details, internal state variables, cached credentials, or other proprietary data structures that are accessible via the compromised API endpoints. The CVSS 3.1 base score of 5.3 reflects a medium severity level, driven primarily by the low attack complexity and lack of required authentication privileges for the attacker, balanced against the limited scope of impact which is confined to confidentiality rather than system-wide compromise or denial of service.
To mitigate this risk, organizations must prioritize patching all affected versions of Oracle Java SE immediately upon applying the relevant security updates provided by Oracle. In addition to updating software, architectural reviews should be conducted to ensure that internal networking APIs are not exposed directly to untrusted networks. Implementing strict network segmentation and firewall rules can restrict access to these services only from authorized IP ranges or trusted subnets. Furthermore, input validation mechanisms should be enforced at the API layer to sanitize incoming data and prevent malformed payloads from triggering the vulnerability. Monitoring for anomalous network traffic patterns associated with excessive requests to networking endpoints may also aid in early detection of exploitation attempts. Adhering to industry standards such as MITRE ATT&CK technique T1078, Valid Accounts, is less relevant here since authentication is not required, but the principle of least privilege should still be applied by ensuring that services running Java SE operate with minimal necessary permissions and network access rights.