CVE-2016-3427
Published 2016-04-21 · Updated 2026-06-17 · Source secalert_us@oracle.com
Summary
CVE-2016-3427 is a critical-severity (CVSS 9.8) vulnerability in Oracle Java SE and JRockit. CISA added it to the Known Exploited Vulnerabilities catalog on May 12, 2023, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 2, 2023. CISA does not currently list it as used in ransomware campaigns. Oracle has 46 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.
All 46 known-exploited Oracle vulnerabilities →Description
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Oracle — Java SE and JRockit
Name: Oracle Java SE and JRockit Unspecified Vulnerability
Date added: 2023-05-12 · Due: 2023-06-02
Required action: Apply updates per vendor instructions.
References
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html