{"id":"CVE-2026-87255","kind":"vulnerability","aliases":["CVE-2026-87255"],"related":[],"title":"Java SE Compiler: low-impact flaw leaks a subset of readable data","description":"Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle Java SE's Compiler component has a flaw that an unauthenticated remote attacker can reach by supplying data to its APIs, such as through a web service. A successful attack allows unauthorized read access to a subset of data the Java SE runtime can reach.","severity":"low","cvss":3.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-java-se","runtime","self-hosted"],"not_affected_if":["auth-required","no-network-service-using-compiler-apis"],"how_to_check":"- `java -version` to see whether the installed Java SE release is 25.0.4.1 or 27\n- Check whether the service passes untrusted input to the Java compiler APIs (javax.tools / javac)","fix":"- Move Oracle Java SE to a patched release listed in the Oracle Critical Patch Update advisory (unknown from the sources)","status":"open","published_at":"2026-10-20T22:20:05+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:43:54+00:00","updated_at":"2026-10-25T04:43:54+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:43:54Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Java SE to a patched release listed in the Oracle Critical Patch Update advisory (unknown from the sources)","reach":"internet","title":"Java SE Compiler: low-impact flaw leaks a subset of readable data","impact":"low","summary":"Oracle Java SE's Compiler component has a flaw that an unauthenticated remote attacker can reach by supplying data to its APIs, such as through a web service. A successful attack allows unauthorized read access to a subset of data the Java SE runtime can reach.","category":"runtime","nicknames":[],"who_cares":["java","oracle-java-se","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads a subset of data accessible to Java SE","analyst_note":"Confirm the patched Java SE release and advisory link from the Oracle Critical Patch Update; sources give no fixed version.","how_to_check":"- `java -version` to see whether the installed Java SE release is 25.0.4.1 or 27\n- Check whether the service passes untrusted input to the Java compiler APIs (javax.tools / javac)","needs_analyst":true,"not_affected_if":["no-network-service-using-compiler-apis","auth-required"],"who_is_affected":"Systems running Oracle Java SE 25.0.4.1 and 27 that hand untrusted data to the Compiler APIs through a network-facing service. The sources say Untrusted Java Web Start applications and Untrusted Java applets are not the path. Teams without such a service can deprioritize it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000635,"input_tokens":3495,"output_tokens":572,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87255':16A,19A '/av':176C '25.0.4.1':91C '27':93C '3.1':166C,175C '3.7':169C 'access':63B,103C,122C,130C 'affect':86C 'allow':60B,98C 'api':50B,143C 'applet':158C 'applic':154C 'attack':42B,59B,100C,113C 'base':167C 'compil':3A,33B,81C 'compon':34B,80C,147C 'compromis':108C 'confidenti':170C 'cve':14A,17A 'cvss':165C,172C,174C 'data':13A,47B,68B,131C,141C 'difficult':94C 'exploit':96C,138C 'flaw':7A,37B 'h/pr':178C 'host':28B 'impact':6A,171C 'java':1A,20B,23B,30B,70B,78C,89C,110C,128C,151C,157C 'l/i':182C 'leak':8A 'low':5A 'low-impact':4A 'multipl':105C 'n':184C 'n/a':183C 'n/ac':177C 'n/s':180C 'n/ui':179C 'network':102C 'note':132C 'oracl':22B,29B,77C,88C,109C,127C 'oracle-java-s':21B 'protocol':106C 'reach':44B,74B 'read':62B,121C 'readabl':12A 'remot':41B 'result':118C 'runtim':25B,72B 'score':168C 'se':2A,24B,31B,71B,79C,90C,111C,129C 'self':27B 'self-host':26B 'servic':56B,164C 'specifi':146C 'start':153C 'subset':10A,66B,125C 'success':58B,112C 'suppli':46B,140C 'support':82C 'u/c':181C 'unauthent':40B,99C 'unauthor':61B,120C 'untrust':150C,156C 'use':149C 'vector':173C 'version':83C 'via':104C 'vulner':75C,97C,116C,134C 'web':55B,152C,163C 'without':148C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Java SE 25.0.4.1 and 27 that hand untrusted data to the Compiler APIs through a network-facing service. The sources say Untrusted Java Web Start applications and Untrusted Java applets are not the path. Teams without such a service can deprioritize it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87255","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87255","severity":null,"published_at":"2026-10-20T22:20:05+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}