Oracle Java SE CVE-2026-87367

Exploitation requires that the target Java/GraalVM deployment pass attacker-controllable data into the affected JAXP (XML processing) APIs - for example, a web service that feeds externally supplied XML/data to those APIs - or that it run untrusted code in a sandboxed Java Web Start application or applet relying on the Java sandbox. Limiting factors: Oracle rates it 'difficult to exploit' (AC:H), impact is confined to partial integrity (unauthorized update/insert/delete of some accessible data) with no confidentiality or availability effect, and the classic sandboxed-applet/Web Start vector is largely deprecated and rare in modern deployments, substantially narrowing realistic exposure.

This is a low-priority issue despite affecting ubiquitous software. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) scores only 3.7 (Low): although it is network-reachable and requires no authentication or user interaction, Oracle explicitly rates it as 'difficult to exploit' (AC:H), and the impact is limited to partial integrity (I:L) with no confidentiality or availability loss. No EPSS score was supplied in the input, it is NOT listed in CISA KEV, and no public proof-of-concept was referenced, so there is no evidence of active or impending exploitation. The one point of tension is the 'Authentication Bypass' tag, which conflicts with the JAXP integrity-corruption nature of the actual description - treat that tag as suspect rather than as a signal of a severe bypass. Net: a genuine but low-severity defect in a hugely deployed platform; patch it on the normal Oracle CPU cadence rather than as an emergency.

An attacker who can supply data to a JAXP-backed API (for example, a public web service that parses attacker-controlled XML) sends specially crafted input that the Java XML processing component mishandles, allowing limited unauthorized modification, insertion, or deletion of some accessible data. A secondary vector applies to sandboxed Java Web Start apps or applets that load untrusted code and rely on the sandbox. No public exploit was identified at time of analysis, and the high attack complexity means reliable exploitation is non-trivial.