Live › vulnerability › CVE-2026-87255
Go to dashboardOracle Java SE's Compiler component has a flaw that an unauthenticated remote attacker can reach by supplying data to its APIs, such as through a web service. A successful attack allows unauthorized read access to a subset of data the Java SE runtime can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running Oracle Java SE 25.0.4.1 and 27 that hand untrusted data to the Compiler APIs through a network-facing service. The sources say Untrusted Java Web Start applications and Untrusted Java applets are not the path. Teams without such a service can deprioritize it.
No product ranges from the sources yet.
java -version to see whether the installed Java SE release is 25.0.4.1 or 27Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87255")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.