Log in Start free

Actively exploited · Published Apr 21, 2016 · Assigned by oracle

CVE-2016-3427

Critical 9.8 Exploited

In plain English

A critical-severity improper access control in Java SE and JRockit from Oracle. Attackers are actively exploiting it in the wild (listed by CISA on May 12, 2023). The chance it is exploited in the next 30 days is estimated at 92.3% (higher than 99.8% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)92.3%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since May 12, 2023
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 2, 2023.

Official description

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References