How do I check whether I am affected by CVE-2026-87294?

- Run `java -version` and compare the output against the affected builds listed in the Oracle advisory (for example `8u503`, `11.0.32.1`, `17.0.20.1`, `21.0.12.1`, `25.0.4.1`). - For GraalVM, run `native-image --version` or `java -version` and check for `17.0.20.1`, `21.0.12.1` or `21.3.19.1.1`.

What is the fix for CVE-2026-87294?

- Update Oracle Java SE to a patched release from the Oracle Critical Patch Update that fixes CVE-2026-87294; the exact fixed builds are unknown from these sources. - Update Oracle GraalVM for JDK and GraalVM Enterprise Edition to the patched release named in the Oracle advisory; unknown from these sources.

Who is not affected by CVE-2026-87294?

Not affected if: no-network-exposed-java, patched-jdk.

Live › vulnerability › CVE-2026-87294

Go to dashboard

medium6.5Runtime

Oracle Java SE: network attacker can read and change some data

A flaw in the Security component of Oracle Java SE and GraalVM lets an unauthenticated attacker over the network modify and read a subset of accessible data. The description notes it can be reached through APIs fed by a web service and also affects sandboxed Java Web Start and applet deployments.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

6.5

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads and modifies some data in the Java runtime.
CVSS said: 6.5. The facts above say high; we keep the sources' medium until an analyst looks.

Who is affected

Any system running an affected Oracle Java SE or GraalVM build that exposes Java code reachable from the network, such as web services that pass input to the vulnerable Security APIs. Client deployments running untrusted code in sandboxed Web Start or applets are also in scope. Systems on patched builds, or with no network-facing Java code, can deprioritise this.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-87294

Go to dashboard

medium6.5Runtime

Oracle Java SE: network attacker can read and change some data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

6.5

medium

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is medium, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads and modifies some data in the Java runtime.
CVSS said: 6.5. The facts above say high; we keep the sources' medium until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Oracle Java SE: network attacker can read and change some data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

Oracle Java SE: network attacker can read and change some data

Why it is medium, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources