CVE-2016-3427: Oracle Java SE and JRockit Unspecified Vulnerability

CISA Known Exploited Vulnerability (KEV)

Description

Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://www.oracle.com/security-alerts/cpuapr2016v3.html; https://nvd.nist.gov/vuln/detail/CVE-2016-3427

Weakness behind it

CISA has not recorded a CWE for this entry, so the CVE → CWE → CAPEC → ATT&CK chain cannot be walked from here. That is a gap in the catalogue, not evidence the vulnerability has no weakness class — check the NVD record below.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2016-3427
• KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog