Vulnerability in Oracle Java SE and GraalVM Products Involving JAXP Component

CVE-2026-87367

What is CVE-2026-87367?

This vulnerability affects multiple versions of Oracle Java SE and GraalVM products through the JAXP component, allowing unauthenticated attackers with network access to potentially compromise the affected systems. Exploitation of this flaw can result in unauthorized access, enabling attackers to execute updates, inserts, or deletions of accessible data. The vulnerability particularly impacts environments using APIs exposed by the JAXP component, including web services interacting with these APIs. It also affects Java deployments in client-side applications that rely on the Java sandbox for security, especially those loading untrusted code from the internet.

References