Oracle Java SE CVE-2026-87291

Exploitation requires that attacker-controlled data reach an API in the affected Networking component - e.g., an application or web service that exposes or forwards untrusted input to that Java SE API over the network. Per Oracle, the flaw is exploited only by supplying data to the specified component's APIs and NOT through untrusted Java Web Start applications or untrusted Java applets. No authentication and no user interaction are required (PR:N/UI:N), and attack complexity is low (AC:L). The principal limiting factor is reachability: a deployed Java application must actually expose the vulnerable Networking API path to the attacker; isolated or non-network-facing JVMs are not exposed, and impact is capped at read access to a subset of data.

Signals are consistent and point to a moderate, not critical, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes an easily exploitable, unauthenticated, network-reachable flaw, but impact is limited to unauthorized read access to a SUBSET of data (C:L only, no integrity or availability impact). No EPSS score is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so there is no evidence of active or imminent exploitation. This is therefore a genuine-but-low-urgency issue: broadly exploitable in principle because of the unauthenticated network vector and the enormous Java install base, yet the capped confidentiality-only impact keeps real-world severity moderate. One conflict to note: the input Tags label this 'Authentication Bypass', but the description and CVSS vector describe a partial information-disclosure flaw with no mention of bypassing authentication - treat the tag as suspect and verify against the Oracle CPU advisory.

A remote, unauthenticated attacker sends crafted data to an exposed Java SE Networking API - for example via a web service that passes attacker-supplied input to the vulnerable component - and obtains unauthorized read access to a subset of Java SE data. No public exploit code is identified at time of analysis, and the attack does not rely on untrusted Java Web Start apps or applets, only on supplying data to the affected APIs.