Log in Start free

Vulnerability · Published Oct 20, 2026 · Assigned by oracle

CVE-2026-87293

Medium 5.4

In plain English

A medium-severity improper access control in Oracle Java SE from Oracle Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.2%top 88.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vulnerability in Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-87293
Ubuntu:24.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.10openjdk-17no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.04:LTSopenjdk-17-cracno fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.10openjdk-17-cracno fix listedUBUNTU-CVE-2026-87293
Ubuntu:22.04:LTSopenjdk-18no fix listedUBUNTU-CVE-2026-87293
Ubuntu:22.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-87293
Ubuntu:24.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.10openjdk-21no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.04:LTSopenjdk-21-cracno fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.10openjdk-21-cracno fix listedUBUNTU-CVE-2026-87293
Ubuntu:22.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-87293
Ubuntu:24.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.10openjdk-25no fix listedUBUNTU-CVE-2026-87293
Ubuntu:22.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-87293
Ubuntu:24.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.10openjdk-8no fix listedUBUNTU-CVE-2026-87293
Ubuntu:22.04:LTSopenjdk-ltsno fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.04:LTSopenjdk-ltsno fix listedUBUNTU-CVE-2026-87293
Ubuntu:26.10openjdk-ltsno fix listedUBUNTU-CVE-2026-87293

Affected products (as reported)

VendorProductVersions
Oracle Corporation Oracle Java SE 8u5038u503-perf

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References