UBUNTU-CVE-2026-87367: Low severity ubuntu/openjdk-8 vulnerability
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~16.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~18.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~18.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~20.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~22.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~24.04.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-27to a version that resolves this vulnerability.Fixed in 27.0.1.0.3+1-1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~26.10.1 - Upgrade
Upgrade
ubuntu/openjdk-25to a version that resolves this vulnerability.Fixed in 25.0.5.0.3+1-1~26.04.1 - Upgrade
Upgrade
ubuntu/openjdk-8to a version that resolves this vulnerability.Fixed in 8u512-b09~us1-0ubuntu1~26.04.1 - Upgrade
Upgrade
ubuntu/openjdk-ltsto a version that resolves this vulnerability.Fixed in 11.0.33+9-1ubuntu1~26.04.1
Event History
Frequently Asked Questions
Which deployment scenarios are most relevant for exposure?
The issue can be reached through APIs in the affected JAXP component, including a web service that supplies data to those APIs. It also applies to clients running sandboxed Java Web Start applications or sandboxed Java applets that load untrusted internet-sourced code and rely on the Java sandbox.
What access does an attacker need to exploit this issue?
An unauthenticated attacker needs network access through multiple protocols. Exploitation is described as difficult, and no user interaction or prior privileges are required.
What is the expected impact of a successful attack?
A successful attack can allow unauthorized update, insert, or delete operations on some accessible data in the affected Java SE or GraalVM deployment. The stated CVSS vector indicates no confidentiality or availability impact.
Which supported releases are identified as affected?
The affected Oracle Java SE releases are 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27. Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1, are also identified.