Vulnerability in Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).

A flaw was found in OpenJDK's Remote Method Invocation (RMI) component. An unauthenticated remote attacker can exploit this vulnerability by sending crafted data to exposed application programming interfaces (APIs). Successful exploitation allows unauthorized modification, deletion, or disclosure of accessible data, potentially impacting other connected systems.

Red Hat rates this vulnerability as Moderate severity because exploitation requires high attack complexity against exposed Remote Method Invocation (RMI) communication channels, without enabling full system compromise. The issue predominantly affects environments utilizing OpenJDK 8 where applications expose RMI endpoints across untrusted networks. Modern runtimes supported on Red Hat Enterprise Linux, including OpenJDK 11 and later versions, do not contain the vulnerable code. Red Hat build of OpenJDK 11 ELS Not affected java-11-openjdk Red Hat build of OpenJDK 11 ELS Not affected java-11-openjdk-portable Red Hat build of OpenJDK 11 ELS Not affected java-11-openjdk-windows Red Hat build of OpenJDK 17 Not affected java-17-openjdk-portable Red Hat build of OpenJDK 17 Not affected java-17-openjdk-windows Red Hat build of OpenJDK 1.8 Affected java-1.8.0-openjdk-portable Red Hat build of OpenJDK 1.8 Affected java-1.8.0-openjdk-windows Red Hat build of OpenJDK 21 Not affected java-21-openjdk-portable Red Hat build of OpenJDK 21 Not affected java-21-openjdk-windows Red Hat build of OpenJDK 25 Not affected java-25-openjdk-portable Red Hat build of OpenJDK 25 Not affected java-25-openjdk-windows Red Hat Enterprise Linux 10 Not affected java-21-ibm-semeru-certified-jdk Red Hat Enterprise Linux 10 Not affected java-21-openjdk Red Hat Enterprise Linux 10 Not affected java-25-openjdk Red Hat Enterprise Linux 6 Out of support scope java-1.6.0-openjdk Red Hat Enterprise Linux 6 Out of support scope java-1.7.0-openjdk Red Hat Enterprise Linux 6 Out of support scope java-1.8.0-openjdk Red Hat Enterprise Linux 7 Out of support scope java-1.6.0-openjdk Red Hat Enterprise Linux 7 Out of support scope java-1.7.0-openjdk Red Hat Enterprise Linux 7 Affected java-1.8.0-openjdk Red Hat Enterprise Linux 8 Not affected java-17-openjdk Red Hat Enterprise Linux 8 Affected java-1.8.0-ibm Red Hat Enterprise Linux 8 Affected java-1.8.0-openjdk Red Hat Enterprise Linux 8 Not affected java-21-openjdk Red Hat Enterprise Linux 9 Not affected java-17-openjdk Red Hat Enterprise Linux 9 Affected java-1.8.0-openjdk Red Hat Enterprise Linux 9 Not affected java-21-openjdk Red Hat Enterprise Linux 9 Not affected java-25-openjdk Red Hat Hardened Images Not affected hi/openjdk Red Hat Hardened Images Not affected java-17-openjdk-portable Red Hat Hardened Images Not affected java-21-openjdk Red Hat Hardened Images Not affected java-21-openjdk-portable Red Hat Hardened Images Not affected java-25-openjdk Red Hat Hardened Images Not affected java-25-openjdk-portable https://www.cve.org/CVERecord?id=CVE-2026-87293 https://nvd.nist.gov/vuln/detail/CVE-2026-87293 https://www.oracle.com/security-alerts/cpuoct2026.html