CVE-2026-87255: Low severity Oracle Java SE vulnerability
Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1 - Upgrade
Upgrade
debian/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5+8-1~deb13u1Fixed in 25.0.5+8-1Fixed in 25.0.5.0.3+1-1 - Upgrade
Upgrade
debian/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1 - Upgrade
Upgrade
alpine/openjdk21to a version that resolves this vulnerability.Fixed in 21.0.13.0.3_p1-r0 - Upgrade
Upgrade
alpine/openjdk25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3_p1-r0 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.04.1
Event History
Frequently Asked Questions
Which Java SE versions are identified as affected?
The affected supported versions are Oracle Java SE 25.0.4.1 and 27.
What does an attacker need to exploit this issue?
An unauthenticated attacker needs network access through one of multiple protocols and must be able to supply data to APIs in the Compiler component, such as through a web service. Exploitation does not require untrusted Java Web Start applications or untrusted Java applets.
What is the expected impact if exploitation succeeds?
Successful exploitation can allow unauthorized read access to a subset of data accessible to Oracle Java SE. The provided CVSS vector indicates confidentiality impact only, with no integrity or availability impact.