---
id: "CVE-2026-87255"
kind: "vulnerability"
aliases: ["CVE-2026-87255"]
title: "Java SE Compiler: low-impact flaw leaks a subset of readable data"
severity: "low"
cvss: 3.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "oracle-java-se", "runtime", "self-hosted"]
not_affected_if: ["auth-required", "no-network-service-using-compiler-apis"]
published_at: "2026-10-20T22:20:05+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:43:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87255", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Java SE Compiler: low-impact flaw leaks a subset of readable data

Oracle Java SE's Compiler component has a flaw that an unauthenticated remote attacker can reach by supplying data to its APIs, such as through a web service. A successful attack allows unauthorized read access to a subset of data the Java SE runtime can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `java -version` to see whether the installed Java SE release is 25.0.4.1 or 27
- Check whether the service passes untrusted input to the Java compiler APIs (javax.tools / javac)

## Fix

- Move Oracle Java SE to a patched release listed in the Oracle Critical Patch Update advisory (unknown from the sources)

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87255

## From the sources

Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_