CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Oracle Java SE and JRockit Unspecified Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Affected products
oracle: jdk; oracle: jre; oracle: jrockit; oracle: linux; canonical: ubuntu linux; debian: debian linux; netapp: e-series santricity management plug-ins; netapp: e-series santricity storage manager; netapp: e-series santricity web services; netapp: oncommand balance; netapp: oncommand cloud manager; netapp: oncommand insight; netapp: oncommand performance manager; netapp: oncommand report; netapp: oncommand shift
References10
- www.oracle.com/technetwork/security-advisory/cpuapr2016v3-29857… PatchVendor Advisory
- www.oracle.com/technetwork/security-advisory/cpuapr2016v3-29857… PatchVendor Advisory
- www.oracle.com/technetwork/topics/security/linuxbulletinapr2016… PatchThird Party Advisory
- lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c1125… Mailing ListPatch
- lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c4783… Mailing ListPatch
- lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73fbc… Mailing ListPatch
- lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade1a… Mailing ListPatch
- lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160bf… Mailing ListPatch
- lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284fb3… Mailing ListPatch
- lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2c7… Mailing ListPatch
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 92% percentile: 100 · as of 8 November 2026
- CWE
- CWE-284
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.