---
id: "CVE-2016-3427"
kind: "vulnerability"
aliases: ["CVE-2016-3427"]
title: "Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Oracle Java SE and JRockit", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "oracle jdk", "fixed": [], "affected": "= 1.6.0", "ecosystem": "vendor"}, {"name": "oracle jdk", "fixed": [], "affected": "= 1.7.0", "ecosystem": "vendor"}, {"name": "oracle jdk", "fixed": [], "affected": "= 1.8.0", "ecosystem": "vendor"}, {"name": "oracle jre", "fixed": [], "affected": "= 1.6.0", "ecosystem": "vendor"}, {"name": "oracle jre", "fixed": [], "affected": "= 1.7.0", "ecosystem": "vendor"}, {"name": "oracle jre", "fixed": [], "affected": "= 1.8.0", "ecosystem": "vendor"}, {"name": "oracle jrockit", "fixed": [], "affected": "= r28.3.9", "ecosystem": "vendor"}, {"name": "oracle linux", "fixed": [], "affected": "= 5", "ecosystem": "vendor"}, {"name": "oracle linux", "fixed": [], "affected": "= 6", "ecosystem": "vendor"}, {"name": "oracle linux", "fixed": [], "affected": "= 7", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 12.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 14.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 15.10", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 16.04", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "netapp e-series santricity management plug-ins", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp e-series santricity storage manager", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp e-series santricity web services", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand balance", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand cloud manager", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand insight", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand performance manager", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand report", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand shift", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand unified manager", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp oncommand workflow automation", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "netapp storagegrid", "fixed": [], "affected": "<= 9.0.4", "ecosystem": "vendor"}, {"name": "netapp vasa provider for clustered data ontap", "fixed": [], "affected": ">= 7.2", "ecosystem": "vendor"}, {"name": "netapp virtual storage console", "fixed": [], "affected": ">= 7.2", "ecosystem": "vendor"}, {"name": "apache cassandra", "fixed": ["2.1.22"], "affected": ">= 2.1.0, < 2.1.22", "ecosystem": "vendor"}, {"name": "apache cassandra", "fixed": ["2.2.18"], "affected": ">= 2.2.0, < 2.2.18", "ecosystem": "vendor"}, {"name": "apache cassandra", "fixed": ["3.0.22"], "affected": ">= 3.0.0, < 3.0.22", "ecosystem": "vendor"}, {"name": "apache cassandra", "fixed": ["3.11.8"], "affected": ">= 3.11.0, < 3.11.8", "ecosystem": "vendor"}, {"name": "apache cassandra", "fixed": [], "affected": "= 4.0.0", "ecosystem": "vendor"}, {"name": "redhat satellite", "fixed": [], "affected": "= 5.6", "ecosystem": "vendor"}, {"name": "redhat satellite", "fixed": [], "affected": "= 5.7", "ecosystem": "vendor"}, {"name": "redhat enterprise linux desktop", "fixed": [], "affected": "= 5.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux desktop", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux desktop", "fixed": [], "affected": "= 7.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 6.7", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "java", "jrockit", "oracle-jdk", "package", "self-hosted", "web-services"]
not_affected_if: ["no-jmx-exposure", "openjdk-only"]
published_at: "2016-04-21T11:00:21+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3427", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3427", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows…

Oracle Java SE and JRockit have an unspecified flaw in the Java Management Extensions (JMX) component that lets a remote attacker affect confidentiality, integrity and availability. It is listed as exploited in the wild, and it can be reached through sandboxed Java applets or Web Start apps, or by sending data to exposed APIs such as a web service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Java SE and JRockit affected ? fixed ?
- vendor:oracle jdk affected = 1.6.0 fixed ?
- vendor:oracle jdk affected = 1.7.0 fixed ?
- vendor:oracle jdk affected = 1.8.0 fixed ?
- vendor:oracle jre affected = 1.6.0 fixed ?
- vendor:oracle jre affected = 1.7.0 fixed ?
- vendor:oracle jre affected = 1.8.0 fixed ?
- vendor:oracle jrockit affected = r28.3.9 fixed ?
- vendor:oracle linux affected = 5 fixed ?
- vendor:oracle linux affected = 6 fixed ?
- vendor:oracle linux affected = 7 fixed ?
- vendor:canonical ubuntu linux affected = 12.04 fixed ?
- vendor:canonical ubuntu linux affected = 14.04 fixed ?
- vendor:canonical ubuntu linux affected = 15.10 fixed ?
- vendor:canonical ubuntu linux affected = 16.04 fixed ?
- vendor:debian linux affected = 8.0 fixed ?
- vendor:netapp e-series santricity management plug-ins affected ? fixed ?
- vendor:netapp e-series santricity storage manager affected ? fixed ?
- vendor:netapp e-series santricity web services affected ? fixed ?
- vendor:netapp oncommand balance affected ? fixed ?
- vendor:netapp oncommand cloud manager affected ? fixed ?
- vendor:netapp oncommand insight affected ? fixed ?
- vendor:netapp oncommand performance manager affected ? fixed ?
- vendor:netapp oncommand report affected ? fixed ?
- vendor:netapp oncommand shift affected ? fixed ?
- vendor:netapp oncommand unified manager affected ? fixed ?
- vendor:netapp oncommand workflow automation affected ? fixed ?
- vendor:netapp storagegrid affected <= 9.0.4 fixed ?
- vendor:netapp vasa provider for clustered data ontap affected >= 7.2 fixed ?
- vendor:netapp virtual storage console affected >= 7.2 fixed ?
- vendor:apache cassandra affected >= 2.1.0, < 2.1.22 fixed 2.1.22
- vendor:apache cassandra affected >= 2.2.0, < 2.2.18 fixed 2.2.18
- vendor:apache cassandra affected >= 3.0.0, < 3.0.22 fixed 3.0.22
- vendor:apache cassandra affected >= 3.11.0, < 3.11.8 fixed 3.11.8
- vendor:apache cassandra affected = 4.0.0 fixed ?
- vendor:redhat satellite affected = 5.6 fixed ?
- vendor:redhat satellite affected = 5.7 fixed ?
- vendor:redhat enterprise linux desktop affected = 5.0 fixed ?
- vendor:redhat enterprise linux desktop affected = 6.0 fixed ?
- vendor:redhat enterprise linux desktop affected = 7.0 fixed ?
- vendor:redhat enterprise linux eus affected = 6.7 fixed ?

## How to check

Run java -version on each host and check whether the JDK or JRE is an Oracle build from before the April 2016 Critical Patch Update.

## Fix

Apply the Oracle Java SE update that contains the April 2016 Critical Patch Update fix, per the vendor instructions CISA references.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-3427
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-3427

## From the sources

Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_