How do I check whether I am affected by CVE-2026-87367?

- Run `java -version` and compare the build with the affected releases: 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1. - Check whether GraalVM for JDK 17.0.20.1 or 21.0.12.1, or GraalVM Enterprise 21.3.19.1.1, is in use. - Look for services that parse untrusted XML through JAXP APIs.

What is the fix for CVE-2026-87367?

- Update Oracle Java SE to the patched release for your line (the Oracle July 2026 Critical Patch Update release for that line). - Update Oracle GraalVM for JDK or GraalVM Enterprise to the patched build for your line. - Rebuild and redeploy applications that bundle their own JDK.

Who is not affected by CVE-2026-87367?

Not affected if: no-untrusted-xml, patched-jdk.

Live › vulnerability › CVE-2026-87367

Go to dashboard

low3.7Runtime

Java SE: JAXP flaw lets remote attacker alter some data

A flaw in the JAXP XML component of Oracle Java SE and GraalVM lets an unauthenticated network attacker make limited unauthorized changes to data the application exposes. The attack is hard to carry out and works through web services that pass data into the affected APIs.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

3.7

low

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is low, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker can change or delete some data the application exposes.
CVSS said: 3.7. The facts above say medium; we keep the sources' low until an analyst looks.

Who is affected

Systems running the listed Oracle Java SE or GraalVM builds that expose JAXP XML processing to untrusted input, such as web services that accept XML from the network. Java applets and Java Web Start clients that run untrusted code are also named in the advisory. Teams that run only patched builds or never parse untrusted XML through JAXP can skip it.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-87367

Go to dashboard

low3.7Runtime

Java SE: JAXP flaw lets remote attacker alter some data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

3.7

low

scored by [email protected]

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 21, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is low, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker can change or delete some data the application exposes.
CVSS said: 3.7. The facts above say medium; we keep the sources' low until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Java SE: JAXP flaw lets remote attacker alter some data

Why it is low, and not just CVSS

Who is affected

Know the next one before it finds you.

Java SE: JAXP flaw lets remote attacker alter some data

Why it is low, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources