CVE-2026-87292 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The identified vulnerability resides within the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products. This security flaw affects a broad range of supported versions including Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1 as well as version 27. The affected GraalVM variants include Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, along with Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The core issue stems from a logic error or improper validation within the networking subsystem that allows an attacker to manipulate data handling mechanisms when interacting with specific application programming interfaces exposed by these components.
This vulnerability is characterized as difficult to exploit, requiring high attack complexity and unauthenticated access over network protocols such as HTTP, HTTPS, or other supported communication channels. The primary impact of a successful exploitation is on the integrity of accessible data managed by the Java runtime environment rather than confidentiality or availability. An attacker can achieve unauthorized update, insert, or delete operations against data that is exposed through the vulnerable APIs. This capability suggests that the flaw likely involves improper authorization checks or input validation failures within network-facing services or endpoints integrated with the Java networking stack, allowing malicious actors to alter stateful information without proper authentication credentials.
The risk profile extends significantly to enterprise environments where these technologies are deployed in client-side contexts. Specifically, Java deployments running sandboxed applications such as Java Web Start apps or legacy Java applets that load and execute untrusted code from external sources remain at risk if they rely on the standard Java security sandbox for protection. In these scenarios, an attacker could potentially bypass expected isolation boundaries by exploiting this networking flaw to modify data accessed by the application logic. This is particularly concerning in environments where applications fetch dynamic content or interact with remote services that supply data directly into the vulnerable API endpoints.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-352 Cross-Site Request Forgery if the exploitation involves tricking users into performing unintended actions via network requests. In terms of adversary tactics, it maps to MITRE ATT&CK technique T1078 Valid Accounts or T1190 Exploit Public-Facing Application depending on whether authentication is bypassed through credential theft or protocol-level manipulation. The CVSS 3.1 base score of 3.7 reflects the low severity due to high complexity and lack of impact on confidentiality and availability, yet it remains critical for maintaining data integrity in sensitive applications.
Mitigation strategies should prioritize immediate patching by upgrading all affected Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations to their latest security update versions provided by Oracle. Organizations must also implement strict network segmentation to limit exposure of systems running these components to untrusted networks. For deployments involving sandboxed applets or Web Start applications, it is advisable to disable the use of legacy Java plugins in web browsers where possible and enforce code signing requirements for any third-party libraries that interact with the networking APIs. Additionally, deploying intrusion detection systems capable of identifying anomalous data modification patterns associated with these specific API endpoints can provide an additional layer of defense against exploitation attempts targeting this integrity-focused vulnerability.