---
id: "CVE-2026-87291"
kind: "vulnerability"
aliases: ["CVE-2026-87291"]
title: "Oracle Java SE: Networking flaw lets unauthenticated attackers read some data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "oracle-java-se", "runtime", "self-hosted"]
not_affected_if: ["no-affected-java-release", "no-network-facing-java-service"]
published_at: "2026-10-20T22:20:06+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T04:23:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87291", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle Java SE: Networking flaw lets unauthenticated attackers read some data

A flaw in the Networking component of Oracle Java SE lets an unauthenticated attacker over the network read a subset of data the runtime can access. Exploitation works by supplying data to Java APIs in that component, such as through a web service, without needing untrusted applets or Web Start apps.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `java -version` and compare the output against the affected releases: Java SE 21.0.12.1, 25.0.4.1 and 27.
- Check whether the team runs a Java service that accepts network input through the Networking APIs.

## Fix

- Move Oracle Java SE to a release that includes the Oracle Critical Patch Update fix for CVE-2026-87291. The sources do not name the fixed build numbers, so check the Oracle advisory.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87291

## From the sources

Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_