Oracle Java SE CVE-2026-87292

Exploitation targets the APIs of the Oracle Java/GraalVM Networking component - typically reached when an application exposes those APIs indirectly, e.g. a web service that supplies attacker-controlled data to them. A second applicable deployment is sandboxed Java Web Start applications or Java applets that load and run untrusted internet-sourced code and rely on the Java sandbox. Key LIMITING factors: Oracle classifies this as 'difficult to exploit' (CVSS AC:H), so success requires specific, hard-to-control timing or state conditions; impact is confined to LOW integrity (limited unauthorized update/insert/delete of some data) with no confidentiality or availability effect; and only the enumerated versions (Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; GraalVM for JDK 17.0.20.1/21.0.12.1; GraalVM EE 21.3.19.1.1) are affected. No authentication is required (PR:N).

This is a low-priority issue despite being network-reachable. The CVSS 3.1 base score is only 3.7, driven entirely by a LOW integrity impact (C:N/I:L/A:N) - there is no confidentiality or availability exposure and no scope change (S:U). The attack vector is network (AV:N) and requires no privileges or user interaction (PR:N/UI:N), but Oracle explicitly rates it 'difficult to exploit' and this is reflected in AC:H (high attack complexity), meaning a successful attack depends on conditions outside the attacker's control. There is no CISA KEV listing, no EPSS score supplied, and no public exploit identified in the provided data, so there is no evidence of active or imminent exploitation. The signals are internally consistent - a genuinely low-risk, hard-to-exploit integrity-only flaw - rather than a high-CVSS/low-real-risk mismatch. Note one metadata conflict: the input Tags include 'Authentication Bypass,' but neither the description nor the CVSS vector supports that classification (this is a Networking-component integrity flaw, not an auth-bypass), so that tag should be treated with suspicion. CWE is listed as N/A, limiting weakness-class analysis.

A remote, unauthenticated attacker repeatedly sends specially crafted data to an exposed API in the Java Networking component - for example through a web service that forwards attacker-controlled input to the affected APIs - and under narrow timing or state conditions (AC:H) achieves limited unauthorized modification, insertion, or deletion of some accessible data. A secondary path applies to sandboxed Java Web Start apps or applets that load untrusted code. No public exploit code was identified at time of analysis.