{"id":"CVE-2026-87293","kind":"vulnerability","aliases":["CVE-2026-87293"],"related":[],"title":"Oracle Java SE: RMI flaw lets unauthenticated network attacker read and alter data","description":"Vulnerability in Oracle Java SE (component: RMI).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).","summary":"A flaw in the RMI component of Oracle Java SE 8 (build 8u503 and the 8u503-perf variant, plus GraalVM Enterprise 21.3.19.1.1) can be exploited by supplying crafted data to its APIs over the network, such as through a web service. A successful attacker gets limited read access and limited update, insert or delete access to data the Java application can reach.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graalvm","java","oracle-java-se","runtime","self-hosted","web-services"],"not_affected_if":["no-network-rmi","other-java-versions","untrusted-input-blocked"],"how_to_check":"- Run `java -version` and confirm whether the build is 8u503 or 8u503-perf\n- Check whether GraalVM Enterprise is in use at `21.3.19.1.1`\n- Find services that use RMI or accept serialized or RMI-related input from the network","fix":"- Move Oracle Java SE 8 to a build newer than `8u503` as published in Oracle's Critical Patch Update\n- Move GraalVM Enterprise to a patched release newer than `21.3.19.1.1`","status":"open","published_at":"2026-10-20T22:20:06+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T04:16:05+00:00","updated_at":"2026-10-25T04:16:05+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:16:05Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Java SE 8 to a build newer than `8u503` as published in Oracle's Critical Patch Update\n- Move GraalVM Enterprise to a patched release newer than `21.3.19.1.1`","reach":"network","title":"Oracle Java SE: RMI flaw lets unauthenticated network attacker read and alter data","impact":"medium","summary":"A flaw in the RMI component of Oracle Java SE 8 (build 8u503 and the 8u503-perf variant, plus GraalVM Enterprise 21.3.19.1.1) can be exploited by supplying crafted data to its APIs over the network, such as through a web service. A successful attacker gets limited read access and limited update, insert or delete access to data the Java application can reach.","category":"runtime","nicknames":[],"who_cares":["java","oracle-java-se","graalvm","self-hosted","web-services"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads and modifies some application data via network requests","analyst_note":"Check Oracle's Critical Patch Update advisory for the fixed Java SE 8 build and the GraalVM patched version; the NVD entry gives no fix version.","how_to_check":"- Run `java -version` and confirm whether the build is 8u503 or 8u503-perf\n- Check whether GraalVM Enterprise is in use at `21.3.19.1.1`\n- Find services that use RMI or accept serialized or RMI-related input from the network","needs_analyst":true,"not_affected_if":["untrusted-input-blocked","no-network-rmi","other-java-versions"],"who_is_affected":"Systems running Oracle Java SE 8 at 8u503 or 8u503-perf, or GraalVM Enterprise 21.3.19.1.1, that expose RMI-handling APIs to untrusted network input such as web services. The sources say exploitation needs no authentication and no user action, but the attack is difficult to carry out. Teams on other Java versions, or with no network-exposed RMI input, can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":3597,"output_tokens":742,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-87293':16A,19A '/av':239C '21.3.19.1.1':55B,121C '3.1':227C,238C '5.4':230C '8':43B '8u503':45B,49B,112C,115C '8u503-perf':48B,114C 'access':81B,88B,131C,169C,176C,183C,191C 'addit':152C 'affect':107C 'allow':126C 'alter':12A 'api':65B,204C 'applet':219C 'applic':93B,215C 'attack':9A,77B,128C,148C,157C 'base':228C 'build':44B 'c/c':244C 'chang':155C 'compon':38B,101C,208C 'compromis':136C 'confidenti':231C 'craft':61B 'cve':14A,17A 'cvss':226C,235C,237C 'data':13A,62B,90B,177C,192C,202C 'delet':87B,168C 'difficult':122C 'edit':120C 'enterpris':54B,119C 'exploit':58B,124C,199C 'flaw':5A,34B 'get':78B 'graalvm':20B,53B,118C 'h/pr':241C 'host':29B 'impact':151C,234C 'insert':85B,166C 'integr':233C 'java':2A,21B,24B,41B,92B,99C,110C,138C,146C,174C,189C,212C,218C 'l/a':246C 'l/i':245C 'let':6A 'limit':79B,83B 'may':149C 'multipl':133C 'n':247C 'n/ac':240C 'n/s':243C 'n/ui':242C 'network':8A,68B,130C 'note':193C 'oracl':1A,23B,40B,98C,109C,117C,137C,145C,173C,188C 'oracle-java-s':22B 'perf':50B,116C 'plus':52B 'product':153C 'protocol':134C 'reach':95B 'read':10A,80B,182C 'result':162C 'rmi':4A,37B,102C 'runtim':26B 'scope':154C 'score':229C 'se':3A,25B,42B,100C,111C,139C,147C,175C,190C 'self':28B 'self-host':27B 'servic':32B,74B,225C 'signific':150C 'specifi':207C 'start':214C 'subset':186C 'success':76B,156C 'suppli':60B,201C 'support':103C 'unauthent':7A,127C 'unauthor':164C,181C 'untrust':211C,217C 'updat':84B,165C 'use':210C 'variant':51B 'vector':236C 'version':104C 'via':132C 'vulner':96C,125C,142C,160C,195C 'web':31B,73B,213C,224C 'web-servic':30B 'well':179C 'without':209C","nicknames":[],"mitigations":[],"who_affected":"Systems running Oracle Java SE 8 at 8u503 or 8u503-perf, or GraalVM Enterprise 21.3.19.1.1, that expose RMI-handling APIs to untrusted network input such as web services. The sources say exploitation needs no authentication and no user action, but the attack is difficult to carry out. Teams on other Java versions, or with no network-exposed RMI input, can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87293","severity":null,"published_at":"2026-10-20T22:20:06+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}