PatchSiren cyber security CVE debrief
CVE-2016-5546 Oracle CVE debrief
CVE-2016-5546 is a network-exploitable Oracle Java libraries vulnerability affecting specified Java SE, Java SE Embedded, and JRockit releases. Oracle/NVD describe unauthenticated access over multiple protocols, with impact focused on unauthorized data creation, deletion, or modification. The issue applies to client and server deployments and can be reached through sandboxed Java Web Start applications, sandboxed Java applets, or direct API input to the affected component.
- Vendor
- Oracle
- Product
- CVE-2016-5546
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-01-27
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-01-27
- Advisory updated
- 2026-05-13
Who should care
Organizations running Oracle Java SE/JRE/JDK, Java SE Embedded, or JRockit at the affected update levels, especially teams supporting browser-based Java or exposed Java APIs.
Technical summary
NVD lists CVSS v3.0 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The affected CPEs include Java SE/JDK/JRE 6u131, 7u121, and 8u111/8u112, plus JRockit R28.3.12. The record says the flaw is easily exploitable, reachable via multiple protocols, and relevant to both sandboxed applets/Web Start and non-sandboxed API inputs.
Defensive priority
High. The vulnerability is unauthenticated, network reachable, and has high integrity impact, so patching should be prioritized on any exposed or legacy Java deployments still using the listed versions.
Recommended defensive actions
- Inventory Java SE, Java SE Embedded, and JRockit instances and confirm whether any match the affected update levels.
- Apply Oracle CPU January 2017 fixes or vendor-supported replacements that supersede the affected versions.
- Remove or restrict browser-based Java applets and Web Start usage, and review any services that pass untrusted data into the affected libraries or APIs.
- Validate downstream vendor advisories and errata for packaged Java runtimes in Linux or appliance images.
- Re-test applications after updating Java, since the issue affects both client and server deployments.
Evidence notes
Based on the NVD CVE record and its reference list, including Oracle’s January 2017 CPU advisory and downstream vendor errata. The supplied enrichment marks this as non-KEV, and no exploit code or confirmed campaign use is present in the corpus.
Official resources
NVD published the CVE record on 2017-01-27T22:59:00.303Z and modified it on 2026-05-13T00:24:29.033Z. The source corpus also references Oracle’s January 2017 CPU advisory and downstream vendor errata.