CVE-2026-87291 - Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.

Vulnerability in Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

MEDIUM

Severity & confidence

Source severitymedium

Platform severitymedium

Confidencehigh

Exploitationunknown

CVSS5.3

Affected

Vendorsoracleapple

Reporting sources (1)

NIST NVD - National Vulnerability Database

Open source ↗

Timeline & provenance

Published2026-10-20T22:20:06

Last updated2026-10-23T22:19:02

Ingested2026-10-23T22:19:02

FreshnessNEAR-REAL-TIME

Threat typevulnerability

Recommended action

No recommended action published with this item - review the original source.

Next steps

Identify affected systems in your environment.
Apply the vendor patch or mitigation guidance.
Review logs for indicators described in the advisory.
Follow the affected vendor/product to track updates.

Confidence explanation

Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).

Source type: standards · Original: NIST NVD - National Vulnerability Database