PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5546 Oracle CVE debrief

CVE-2016-5546 is a network-exploitable Oracle Java libraries vulnerability affecting specified Java SE, Java SE Embedded, and JRockit releases. Oracle/NVD describe unauthenticated access over multiple protocols, with impact focused on unauthorized data creation, deletion, or modification. The issue applies to client and server deployments and can be reached through sandboxed Java Web Start applications, sandboxed Java applets, or direct API input to the affected component.

Vendor
Oracle
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Organizations running Oracle Java SE/JRE/JDK, Java SE Embedded, or JRockit at the affected update levels, especially teams supporting browser-based Java or exposed Java APIs.

Technical summary

NVD lists CVSS v3.0 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The affected CPEs include Java SE/JDK/JRE 6u131, 7u121, and 8u111/8u112, plus JRockit R28.3.12. The record says the flaw is easily exploitable, reachable via multiple protocols, and relevant to both sandboxed applets/Web Start and non-sandboxed API inputs.

Defensive priority

High. The vulnerability is unauthenticated, network reachable, and has high integrity impact, so patching should be prioritized on any exposed or legacy Java deployments still using the listed versions.

Recommended defensive actions

  • Inventory Java SE, Java SE Embedded, and JRockit instances and confirm whether any match the affected update levels.
  • Apply Oracle CPU January 2017 fixes or vendor-supported replacements that supersede the affected versions.
  • Remove or restrict browser-based Java applets and Web Start usage, and review any services that pass untrusted data into the affected libraries or APIs.
  • Validate downstream vendor advisories and errata for packaged Java runtimes in Linux or appliance images.
  • Re-test applications after updating Java, since the issue affects both client and server deployments.

Evidence notes

Based on the NVD CVE record and its reference list, including Oracle’s January 2017 CPU advisory and downstream vendor errata. The supplied enrichment marks this as non-KEV, and no exploit code or confirmed campaign use is present in the corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-5546 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-5546

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-5546 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-5546

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.