CVEvulnerability

CVE-2016-3427

9.8 CRITICAL Known exploited Published 2016-04-21 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Oracle Java SE and JRockit Unspecified Vulnerability — Oracle Java SE and JRockit

Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

Added to KEV
2023-05-12
Remediation due
2023-06-02
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://www.oracle.com/security-alerts/cpuapr2016v3.html; https://nvd.nist.gov/vuln/detail/CVE-2016-3427
Status
Analyzed
Published
2016-04-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-284

Description

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

Affected configurations

• oracle jdk 1.6.0 • oracle jdk 1.7.0 • oracle jdk 1.8.0 • oracle jre 1.6.0 • oracle jre 1.7.0 • oracle jre 1.8.0 • oracle jrockit r28.3.9 • oracle linux 5 • oracle linux 6 • oracle linux 7 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 15.10 • canonical ubuntu linux 16.04 • debian debian linux 8.0 • netapp e-series santricity management plug-ins • netapp e-series santricity storage manager • netapp e-series santricity web services • netapp oncommand balance • netapp oncommand cloud manager • netapp oncommand insight • netapp oncommand performance manager • netapp oncommand report • netapp oncommand shift • netapp oncommand unified manager • netapp oncommand workflow automation • netapp storagegrid (<= 9.0.4) • netapp vasa provider for clustered data ontap (>= 7.2) • netapp virtual storage console (>= 7.2) • apache cassandra (>= 2.1.0 < 2.1.22) • apache cassandra (>= 2.2.0 < 2.2.18) • apache cassandra (>= 3.0.0 < 3.0.22) • apache cassandra (>= 3.11.0 < 3.11.8) • apache cassandra 4.0.0 • redhat satellite 5.6 • redhat satellite 5.7 • redhat enterprise linux desktop 5.0 • redhat enterprise linux desktop 6.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux eus 6.7 • redhat enterprise linux eus 7.2 • redhat enterprise linux eus 7.3 • redhat enterprise linux eus 7.4 • redhat enterprise linux eus 7.5 • redhat enterprise linux eus 7.6 • redhat enterprise linux eus 7.7 • redhat enterprise linux server 5.0 • redhat enterprise linux server 6.0 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.2 • redhat enterprise linux server aus 7.3 • redhat enterprise linux server aus 7.4 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server aus 7.7 • redhat enterprise linux server eus 6.7 • redhat enterprise linux server eus 7.2 • redhat enterprise linux server tus 7.2 • redhat enterprise linux server tus 7.3 • redhat enterprise linux server tus 7.6 • redhat enterprise linux server tus 7.7 … and 16 more

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References