Description
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized read access to Java SE data
Action: Patch
AI Analysis

Impact

A vulnerability exists in the Networking component of Oracle Java SE that permits an unauthenticated attacker to supply crafted data to vulnerable APIs. The flaw leads to confidential information disclosure, allowing the exploitation to read a subset of Java SE accessible data. The CVSS v3.1 base score of 5.3 reflects a low confidentiality impact, with no effect on integrity or availability.

Affected Systems

The affected products are Oracle Java SE 21.0.12.1, 25.0.4.1, and 27, all running the default networking component. The issue specifically targets the APIs exposed by this component and is not triggered by Untrusted Java Web Start applications or applets.

Risk and Exploitability

The threat vector is network‑based; an attacker with network connectivity and the ability to contact the vulnerable APIs can leverage the fault. Because the flaw requires only unauthenticated access, the likelihood of exploitation is somewhat elevated, but the CVSS score indicates a moderate risk. The EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploits at this time. The impact is limited to confidentiality, and any successful attack would grant read access to a restricted subset of data available through the exposed APIs.

Generated by OpenCVE AI on October 28, 2026 at 00:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Java SE update that remedies the networking component vulnerability for all affected releases.
  • If an update is not in immediate reach, restrict or disable the network protocols that expose the vulnerable APIs on the impacted Java SE installations.
  • Enforce firewall or access‑control rules to limit inbound traffic to trusted hosts and monitor for anomalous API usage to detect attempted exploitation.

Generated by OpenCVE AI on October 28, 2026 at 00:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Thu, 22 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200

Thu, 22 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title Oracle Java SE Network API Data Exposure Vulnerability openjdk: Enhance HTTP Server (Oracle CPU 2026-10)
Weaknesses CWE-22
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 22 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Title Oracle Java SE Network API Data Exposure Vulnerability
Weaknesses CWE-200

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle oracle Java Se
Vendors & Products Oracle oracle Java Se

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle java Se
CPEs cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle java Se
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Java Se Oracle Java Se
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T18:52:59.378Z

Reserved: 2026-09-08T21:49:12.409Z

Link: CVE-2026-87291

cve-icon Vulnrichment

Updated: 2026-10-27T18:52:41.963Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:06.047

Modified: 2026-10-27T19:17:31.040

Link: CVE-2026-87291

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-20T21:23:51Z

Links: CVE-2026-87291 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T00:30:14Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-287

    Improper Authentication