Live › vulnerability › CVE-2026-87291
Go to dashboardA flaw in the Networking component of Oracle Java SE lets an unauthenticated attacker over the network read a subset of data the runtime can access. Exploitation works by supplying data to Java APIs in that component, such as through a web service, without needing untrusted applets or Web Start apps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle Java SE 21.0.12.1, 25.0.4.1 or 27 on a server that processes network input through the affected Networking APIs, such as a web service, are exposed. Systems that do not run these Java releases, or that run Java only on the local machine without accepting network data, are unlikely to be exposed.
No product ranges from the sources yet.
java -version and compare the output against the affected releases: Java SE 21.0.12.1, 25.0.4.1 and 27.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-87291")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.