CVE-2026-87291

Awaiting Analysis Awaiting Analysis - Queue

Oracle Java SE Information Disclosure Vulnerability

Publication date: 2026-10-20

Last updated on: 2026-10-27

Assigner: Oracle

Description

Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-87291

EUVD

EUVD-2026-106332

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle Corporation	Oracle Java SE	21.0.12.1
Oracle Corporation	Oracle Java SE	25.0.4.1
Oracle Corporation	Oracle Java SE	27

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Java SE's Networking component affecting versions 21.0.12.1, 25.0.4.1, and 27. An unauthenticated attacker can remotely exploit it via multiple protocols to gain unauthorized read access to some Oracle Java SE data. Exploitation requires supplying data to specific APIs without using Untrusted Java Web Start or applets, such as through a web service.

Detection Guidance

This vulnerability is specific to Oracle Java SE versions 21.0.12.1, 25.0.4.1, and 27. Detection requires checking installed Java versions and applying Oracle's security patches. No direct network or system commands are provided in the CVE details for detection.

Impact Analysis

An attacker could read sensitive data exposed by the affected Java SE versions. Since exploitation is network-based and does not require authentication, systems running vulnerable Java versions may be at risk if accessible over a network. The impact is limited to data confidentiality, not code execution or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations must assess if their Java SE deployments are affected and apply mitigations to maintain compliance.

Mitigation Strategies

Update Oracle Java SE to versions 21.0.13, 25.0.5, or 27.1 or later to address the vulnerability. Monitor Oracle's security advisories for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-87291. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...