{"id":"CVE-2026-87291","kind":"vulnerability","aliases":["CVE-2026-87291"],"related":[],"title":"Oracle Java SE: Networking flaw lets unauthenticated attackers read some data","description":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"A flaw in the Networking component of Oracle Java SE lets an unauthenticated attacker over the network read a subset of data the runtime can access. Exploitation works by supplying data to Java APIs in that component, such as through a web service, without needing untrusted applets or Web Start apps.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-java-se","runtime","self-hosted"],"not_affected_if":["no-affected-java-release","no-network-facing-java-service"],"how_to_check":"- Run `java -version` and compare the output against the affected releases: Java SE 21.0.12.1, 25.0.4.1 and 27.\n- Check whether the team runs a Java service that accepts network input through the Networking APIs.","fix":"- Move Oracle Java SE to a release that includes the Oracle Critical Patch Update fix for CVE-2026-87291. The sources do not name the fixed build numbers, so check the Oracle advisory.","status":"open","published_at":"2026-10-20T22:20:06+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:23:00+00:00","updated_at":"2026-10-25T04:23:00+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:23:00Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Java SE to a release that includes the Oracle Critical Patch Update fix for CVE-2026-87291. The sources do not name the fixed build numbers, so check the Oracle advisory.","reach":"internet","title":"Oracle Java SE: Networking flaw lets unauthenticated attackers read some data","impact":"low","summary":"A flaw in the Networking component of Oracle Java SE lets an unauthenticated attacker over the network read a subset of data the runtime can access. Exploitation works by supplying data to Java APIs in that component, such as through a web service, without needing untrusted applets or Web Start apps.","category":"runtime","nicknames":[],"who_cares":["java","oracle-java-se","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reads a subset of data accessible to the Java runtime","analyst_note":"Find the fixed Java build numbers and the affected Networking APIs in the Oracle Critical Patch Update advisory for this CVE.","how_to_check":"- Run `java -version` and compare the output against the affected releases: Java SE 21.0.12.1, 25.0.4.1 and 27.\n- Check whether the team runs a Java service that accepts network input through the Networking APIs.","needs_analyst":true,"not_affected_if":["no-affected-java-release","no-network-facing-java-service"],"who_is_affected":"Teams running Oracle Java SE 21.0.12.1, 25.0.4.1 or 27 on a server that processes network input through the affected Networking APIs, such as a web service, are exposed. Systems that do not run these Java releases, or that run Java only on the local machine without accepting network data, are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000667,"input_tokens":3502,"output_tokens":633,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87291':14A,17A '/av':179C '21.0.12.1':94C '25.0.4.1':95C '27':97C '3.1':169C,178C '5.3':172C 'access':52B,106C,125C,133C 'affect':89C 'allow':101C 'api':60B,146C 'app':77B 'applet':73B,161C 'applic':157C 'attack':8A,40B,103C,116C 'base':170C 'compon':32B,63B,83C,150C 'compromis':111C 'confidenti':173C 'cve':12A,15A 'cvss':168C,175C,177C 'data':11A,48B,57B,134C,144C 'easili':98C 'exploit':53B,99C,141C 'flaw':5A,28B 'host':26B 'impact':174C 'java':2A,18B,21B,35B,59B,81C,92C,113C,131C,154C,160C 'l/i':185C 'l/pr':181C 'let':6A,37B 'multipl':108C 'n':187C 'n/a':186C 'n/ac':180C 'n/s':183C 'n/ui':182C 'need':71B 'network':4A,31B,43B,84C,105C 'note':135C 'oracl':1A,20B,34B,80C,91C,112C,130C 'oracle-java-s':19B 'protocol':109C 'read':9A,44B,124C 'result':121C 'runtim':23B,50B 'score':171C 'se':3A,22B,36B,82C,93C,114C,132C 'self':25B 'self-host':24B 'servic':69B,167C 'specifi':149C 'start':76B,156C 'subset':46B,128C 'success':115C 'suppli':56B,143C 'support':85C 'u/c':184C 'unauthent':7A,39B,102C 'unauthor':123C 'untrust':72B,153C,159C 'use':152C 'vector':176C 'version':86C 'via':107C 'vulner':78C,100C,119C,137C 'web':68B,75B,155C,166C 'without':70B,151C 'work':54B","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Java SE 21.0.12.1, 25.0.4.1 or 27 on a server that processes network input through the affected Networking APIs, such as a web service, are exposed. Systems that do not run these Java releases, or that run Java only on the local machine without accepting network data, are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87291","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87291","severity":null,"published_at":"2026-10-20T22:20:06+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}