Live › vulnerability › CVE-2016-3427
Go to dashboardOracle Java SE and JRockit have an unspecified flaw in the Java Management Extensions (JMX) component that lets a remote attacker affect confidentiality, integrity and availability. It is listed as exploited in the wild, and it can be reached through sandboxed Java applets or Web Start apps, or by sending data to exposed APIs such as a web service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Oracle Java SE and JRockit | vendor | – | – |
| oracle jdk | vendor | = 1.6.0 | – |
| oracle jdk | vendor | = 1.7.0 | – |
| oracle jdk | vendor | = 1.8.0 | – |
| oracle jre | vendor | = 1.6.0 | – |
| oracle jre | vendor | = 1.7.0 | – |
| oracle jre | vendor | = 1.8.0 | – |
| oracle jrockit | vendor | = r28.3.9 | – |
| oracle linux | vendor | = 5 | – |
| oracle linux | vendor | = 6 | – |
| oracle linux | vendor | = 7 | – |
| canonical ubuntu linux | vendor | = 12.04 | – |
| canonical ubuntu linux | vendor | = 14.04 | – |
| canonical ubuntu linux | vendor | = 15.10 | – |
| canonical ubuntu linux | vendor | = 16.04 | – |
| debian linux | vendor | = 8.0 | – |
| netapp e-series santricity management plug-ins | vendor | – | – |
| netapp e-series santricity storage manager | vendor | – | – |
| netapp e-series santricity web services | vendor | – | – |
| netapp oncommand balance | vendor | – | – |
| netapp oncommand cloud manager | vendor | – | – |
| netapp oncommand insight | vendor | – | – |
| netapp oncommand performance manager | vendor | – | – |
| netapp oncommand report | vendor | – | – |
| netapp oncommand shift | vendor | – | – |
| netapp oncommand unified manager | vendor | – | – |
| netapp oncommand workflow automation | vendor | – | – |
| netapp storagegrid | vendor | <= 9.0.4 | – |
| netapp vasa provider for clustered data ontap | vendor | >= 7.2 | – |
| netapp virtual storage console | vendor | >= 7.2 | – |
| apache cassandra | vendor | >= 2.1.0, < 2.1.22 | 2.1.22 |
| apache cassandra | vendor | >= 2.2.0, < 2.2.18 | 2.2.18 |
| apache cassandra | vendor | >= 3.0.0, < 3.0.22 | 3.0.22 |
| apache cassandra | vendor | >= 3.11.0, < 3.11.8 | 3.11.8 |
| apache cassandra | vendor | = 4.0.0 | – |
| redhat satellite | vendor | = 5.6 | – |
| redhat satellite | vendor | = 5.7 | – |
| redhat enterprise linux desktop | vendor | = 5.0 | – |
| redhat enterprise linux desktop | vendor | = 6.0 | – |
| redhat enterprise linux desktop | vendor | = 7.0 | – |
| redhat enterprise linux eus | vendor | = 6.7 | – |
Run java -version on each host and check whether the JDK or JRE is an Oracle build from before the April 2016 Critical Patch Update.
Apply the Oracle Java SE update that contains the April 2016 Critical Patch Update fix, per the vendor instructions CISA references.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2016-3427")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.