CVE-2026-87293 in Java SE
Summary
by MITRE • 10/21/2026
Vulnerability in Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Remote Method Invocation component of Oracle Java SE, specifically affecting versions such as Oracle Java SE 8u503 and its performance variant, as well as Oracle GraalVM Enterprise Edition version 21.3.19.1.1. This flaw represents a significant security risk because it allows an unauthenticated attacker with network access to compromise the integrity of the system through multiple protocols. The core technical issue stems from how the RMI subsystem processes incoming data, where specific API calls can be manipulated by external entities without requiring prior authentication or user interaction. Unlike many other Java vulnerabilities that rely on social engineering via applets or Web Start applications, this particular weakness is exploitable directly through service interfaces and networked APIs, making it accessible to remote adversaries who can interact with the exposed endpoints.
From a technical perspective, the vulnerability enables unauthorized modifications to data accessible by Oracle Java SE, including updates, inserts, and deletions, alongside unauthorized read access to certain subsets of that same data. This dual impact on both confidentiality and integrity is particularly dangerous because it allows an attacker not only to steal sensitive information but also to alter critical system states or database records without detection in many scenarios. The scope change noted in the advisory indicates that while the flaw originates within Java SE, its exploitation can have cascading effects on additional products dependent on this component, thereby expanding the blast radius of a successful attack beyond just the immediate application layer.
The operational impact is characterized by a moderate severity level, reflected in a CVSS 3.1 Base Score of 5.4 with a vector string indicating network-based access, high complexity, no required privileges or user interaction, and a changed scope that affects confidentiality and integrity but not availability. The high attack complexity suggests that while the vulnerability is exploitable, it requires precise conditions or specific knowledge of the target environment to succeed reliably. However, the absence of authentication requirements significantly lowers the barrier for entry compared to authenticated flaws. Attackers must supply malicious data directly to APIs within the affected component, bypassing traditional defenses like untrusted applet sandboxes which are no longer a relevant vector in modern Java deployments.
In terms of classification standards, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-918 Server-Side Request Forgery if it involves manipulating internal resources through the RMI interface. It also maps to MITRE ATT&CK techniques related to Remote Services exploitation, specifically those involving API abuse or unauthorized data access via network protocols. The lack of user interaction requirement places this in a category of vulnerabilities that are particularly dangerous for automated scanning and exploitation tools used by threat actors seeking widespread compromise.
Mitigation strategies must focus on immediate patching to the latest supported versions of Oracle Java SE and GraalVM Enterprise Edition, as these updates contain fixes for the underlying input validation logic within the RMI subsystem. Organizations should also implement network segmentation to restrict access to RMI ports from untrusted networks, ensuring that only authorized services can communicate with the affected components. Additionally, deploying intrusion detection systems configured to monitor for anomalous patterns in remote method invocation traffic can help identify attempted exploitation activities before they result in data compromise. Regular auditing of API endpoints and enforcing strict authentication mechanisms where possible further reduces the attack surface associated with this vulnerability.