Oracle Java SE CVE-2026-87293

Exploitation requires supplying attacker-controlled data directly to the affected RMI component APIs - explicitly through non-applet/non-Java-Web-Start paths such as a web service - meaning a reachable deployment that exposes RMI API processing to untrusted input. The vulnerability is unauthenticated (PR:N) and needs no user interaction (UI:N), but is strongly limited by high attack complexity (AC:H, Oracle-rated 'difficult to exploit'), likely requiring specific timing or conditions outside the attacker's control. Impact is further bounded to partial confidentiality and integrity (C:L/I:L, no availability loss), with the scope change (S:C) being the factor that allows effects to extend to additional products.

Signals point to a genuine but moderate-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, base 5.4) shows a network-reachable, unauthenticated flaw, which normally elevates urgency, but Oracle explicitly labels it 'difficult to exploit' and the vector confirms AC:H - a meaningful mitigating factor that lowers real-world exploitability. Impact is limited and partial: C:L and I:L (some unauthorized read, and update/insert/delete to a subset of data) with no availability impact (A:N), though the scope change (S:C) means successful attacks can reach additional products beyond Java SE, which is what keeps the score at 5.4 rather than lower. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the exploitation signals and the severity signal are therefore consistent (moderate severity, low observed exploitation). The 'Authentication Bypass' tag conflicts with the actual vulnerability, which is an RMI data-integrity/confidentiality flaw - verify tagging. CWE is N/A, so the exact weakness class is not confirmed from the input.

A remote, unauthenticated attacker reaches a network-exposed Oracle Java SE RMI endpoint and supplies crafted data directly to the affected RMI APIs - for example via a web service front-end rather than through Java Web Start or applets. Successfully winning the required race/complexity conditions lets them read a subset of accessible data and perform some unauthorized update, insert, or delete operations, with effects potentially extending to other products due to the scope change. No public exploit code was identified in the provided data, and Oracle rates the vulnerability difficult to exploit (AC:H).