CVE-2026-87291 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Java SE deployments, particularly those using versions 21.0.12.1, 25.0.4.1, and 27, should assess their exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-87291 is a medium-severity vulnerability in Oracle Java SE's Networking component that allows unauthenticated attackers to compromise the system and access sensitive data. Defenders should prioritize verifying exposure, applying patches, and monitoring for potential security incidents.

• Potential unauthorized read access to sensitive data.
• Need to verify exposure of affected Oracle Java SE versions.
• Priority on applying patches or mitigations to prevent exploitation.
• Importance of monitoring for potential security incidents related to this vulnerability.

Technical summary

The vulnerability in Oracle Java SE's Networking component allows unauthenticated attackers with network access via multiple protocols to compromise the system, potentially leading to unauthorized read access to a subset of accessible data. The CVSS 3.1 Base Score is 5.3, indicating a medium severity. This vulnerability affects Oracle Java SE versions 21.0.12.1, 25.0.4.1, and 27. Defenders should prioritize verifying exposure of these versions and applying patches or mitigations as available. The vulnerability can be exploited without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service.

Defensive priority

Defenders should prioritize verifying exposure of Oracle Java SE versions 21.0.12.1, 25.0.4.1, and 27, and applying patches or mitigations as available.

Recommended defensive actions

• Verify exposure of Oracle Java SE versions 21.0.12.1, 25.0.4.1, and 27 in your environment.
• Apply patches or mitigations as available from Oracle.
• Monitor for potential unauthorized access to sensitive data.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.3 and potential impacts on confidentiality. The vulnerability affects Oracle Java SE versions 21.0.12.1, 25.0.4.1, and 27. Defenders should verify exposure and apply patches or mitigations as available. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessments. Oracle's security alert page provides additional details on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.