Description
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read access
Action: Apply patch
AI Analysis

Impact

The flaw resides in the compiler sub‑component of Oracle Java SE. An unauthenticated attacker who can reach the exposed Java SE APIs over the network can supply crafted input that triggers an out‑of‑bounds read (CWE‑125) and bypasses authentication (CWE‑287). When triggered, the vulnerability allows the attacker to read a limited set of data that is normally protected within the Java SE environment. No integrity or availability effects are reported.

Affected Systems

Oracle Java SE 25.0.4.1 and 27 contain the vulnerable compiler component. Only those releases are susceptible; the issue does not affect other Java SE releases or components such as Java Web Start or applets.

Risk and Exploitability

The CVSS 3.1 base score of 3.7 reflects a low confidentiality impact, and the EPSS score of less than 1 % indicates a very low probability of exploitation. The vulnerability is not in the CISA KEV catalog. Exploitation requires network access to specific compiler APIs—typically via a web service—and the attacker must craft input that is not constrained to untrusted Java Web Start applications or applets. Because the conditions are restrictive and the impact is limited to a subset of data, the overall risk is considered low for most deployments.

Generated by OpenCVE AI on October 28, 2026 at 01:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check Oracle security alerts for the latest patch or upgrade to a Java SE release that removes the vulnerable compiler component.
  • Apply the official patch or perform an upgrade to a version that contains the fix.
  • Restrict network exposure of Java SE services, allowing only trusted hosts or internal networks to access the compiler APIs.

Generated by OpenCVE AI on October 28, 2026 at 01:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Thu, 22 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-200

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated read access via Java SE Compiler openjdk: Enhance Vector Processing (Oracle CPU 2026-10)
Weaknesses CWE-125
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle oracle Java Se
Vendors & Products Oracle oracle Java Se

Wed, 21 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated read access via Java SE Compiler
Weaknesses CWE-20
CWE-200

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle java Se
CPEs cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle java Se
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T18:50:10.598Z

Reserved: 2026-09-08T21:49:12.407Z

Link: CVE-2026-87255

cve-icon Vulnrichment

Updated: 2026-10-27T18:49:47.039Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:05.710

Modified: 2026-10-27T19:17:30.777

Link: CVE-2026-87255

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-20T21:23:50Z

Links: CVE-2026-87255 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:15:12Z

Weaknesses