Oracle Java SE CVE-2026-87290

Exploitation requires that a vulnerable Oracle Java SE / GraalVM runtime process attacker-supplied data through the JAXP (XML processing) APIs - Oracle notes this typically occurs via a web service that feeds data into the specified APIs, or via sandboxed Java Web Start applications / applets that load and run untrusted internet-sourced code and rely on the Java sandbox. Exploitation is LIMITED by HIGH attack complexity (AC:H), meaning specific conditions in the parser or supplied data must be met; impact is confined to confidentiality (information disclosure) with no integrity or availability effect. The client/applet path is increasingly non-default since Java Web Start and browser applet support are deprecated/removed in modern JDKs, narrowing that avenue to legacy deployments.

This is a moderate-priority issue, not a top-tier emergency, despite the ubiquity of the affected product. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) shows a network-reachable, unauthenticated flaw but with HIGH attack complexity and impact limited to confidentiality only (no integrity or availability impact, no scope change). Oracle itself characterizes it as 'difficult to exploit.' No EPSS score was provided in the input, there is no CISA KEV listing, and no public POC is referenced - so all three real-world exploitation signals are either absent or negative, which argues against imminent mass exploitation. No SSVC decision data was supplied. The counterbalancing factor is prevalence: JAXP is a core XML-processing component shipped in every Oracle Java SE / GraalVM runtime, so the attack surface is enormous wherever these runtimes parse attacker-influenced XML. Net assessment: high-value target class but a genuinely hard-to-exploit, confidentiality-only bug - patch on the normal Oracle CPU cadence rather than as an out-of-band fire drill.

An attacker sends specially crafted XML/data to a network-facing service that internally uses a vulnerable JAXP API (e.g., a SOAP/REST endpoint that parses untrusted XML), causing the parser to disclose sensitive data (consistent with the C:H, I:N, A:N confidentiality-only impact). Alternatively, in the legacy sandbox model, a sandboxed Java Web Start app or applet loading untrusted code could abuse JAXP to read data it should not reach. No public exploit is known, and the HIGH attack complexity (AC:H) means exploitation likely requires specific parser configurations or data conditions rather than a trivial single request.