CVE-2016-3427

CRITICAL(9.8)KEVLikely Exploited

Oracle Java SE and JRockit Unspecified Vulnerability

Description

CVE-2016-3427 is a critical vulnerability in Oracle Java SE, Java SE Embedded, and JRockit affecting the Java Management Extensions (JMX) component. The flaw impacts Java SE versions 6u113, 7u99, and 8u77, Java SE Embedded 8u77, and JRockit R28.3.9, allowing remote unauthenticated attackers to fully compromise the confidentiality, integrity, and availability of the affected system. With a CVSS score of 9.8 (Critical) and an EPSS score of 93.6% (99th percentile), CVE-2016-3427 represents one of the most likely-to-be-exploited vulnerabilities in the Java ecosystem. CISA has confirmed active exploitation in the wild by adding this vulnerability to its Known Exploited Vulnerabilities catalog. The vulnerability also has downstream implications for Apache Tomcat and Apache Cassandra deployments that use JMX.

KEV Information

Vendor
Oracle
Product
Java SE and JRockit
Date Added
May 12, 2023
Due Date
June 2, 2023
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

CWEs

CWE-284Access Control

Improper Access Control

Affected Products

VendorProductVersion
oraclejdk1.6.0; 1.7.0; 1.8.0
oraclejre1.6.0; 1.7.0; 1.8.0
oraclejrockitr28.3.9
oraclelinux5; 6; 7
canonicalubuntu linux12.04; 14.04; 15.10; 16.04
debiandebian linux8.0
netappe-series santricity management plug-ins-
netappe-series santricity storage manager-
netappe-series santricity web services-
netapponcommand balance-
netapponcommand cloud manager-
netapponcommand insight-
netapponcommand performance manager-
netapponcommand report-
netapponcommand shift-
netapponcommand unified manager-
netapponcommand workflow automation-
netappstoragegrid<= 9.0.4
netappvasa provider for clustered data ontap>= 7.2
netappvirtual storage console>= 7.2

Multiple CVSS Assessments

Source: [email protected](Primary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-284: Improper Access Control

CWE-284 describes a weakness where software does not properly restrict access to resources or functionality, allowing unauthorized actors to perform privileged operations. In CVE-2016-3427, the JMX component in Oracle Java fails to enforce proper access controls on credential handling, enabling remote attackers to exploit the JMX interface without authentication and achieve full system compromise.

Learn more: CWE-284 — Improper Access Control

Impact Analysis

Attack Vector (Network): CVE-2016-3427 is remotely exploitable without physical access, meaning any attacker who can reach the JMX port over the network can launch an attack. Attack Complexity (Low): No special conditions or preparation are required to exploit this vulnerability, making it easy to attack at scale. Privileges Required (None): No authentication credentials are needed, allowing completely unauthenticated exploitation. User Interaction (None): No action from a legitimate user is needed for the attack to succeed. Confidentiality, Integrity, and Availability (All High): Successful exploitation of CVE-2016-3427 results in complete system compromise, enabling an attacker to read all data, modify system configurations, and disrupt services entirely. The CVSS score of 9.8 (Critical) reflects the maximum possible impact across all three CIA dimensions combined with trivial exploitability. The EPSS score of 93.6% (99th percentile) indicates near-certain exploitation activity, placing CVE-2016-3427 among the most dangerous actively exploited vulnerabilities. CISA has confirmed active exploitation and the broad range of affected products—including Oracle JDK/JRE, NetApp storage products, and downstream Apache projects—significantly amplifies the risk.

Exploit Maturity

Active exploitation of CVE-2016-3427 has been confirmed by CISA, which added this critical Oracle Java vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 93.6% places this vulnerability in the 99th percentile, indicating near-certain exploitation activity across the threat landscape. While no specific references in the NVD data are tagged as "Exploit," the vulnerability's trivial exploitation requirements—network-accessible, no authentication, no user interaction—combined with the widespread deployment of Java SE make it an extremely attractive target. The ransomware usage status is currently unknown, but the ability to achieve remote code execution without authentication makes this vulnerability a prime candidate for use in ransomware and other malware campaigns. Notably, CVE-2016-3427 is related to Apache Tomcat's CVE-2016-8735, where the JmxRemoteLifecycleListener was not updated for consistency with Oracle's patch, creating a chained attack scenario for Tomcat deployments.

Remediation

  1. Apply Oracle's Critical Patch Update immediately as directed by CISA's required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Upgrade to Java SE 6u121, 7u111, 8u101 or later, and JRockit R28.3.10 or later, as provided in Oracle's April 2016 CPU.
  2. Update all downstream products that embed or depend on Java SE: apply distribution-specific patches for Debian (DSA-3558), Ubuntu (USN-2963-1, USN-2964-1, USN-2972-1), Red Hat Enterprise Linux (RHSA-2016-0650 through RHSA-2016-0723), SUSE/openSUSE (relevant SU advisories), and Gentoo (GLSA-201606-18). For NetApp products, apply NTAP-20160420-0001.
  3. Restrict JMX port access by implementing firewall rules to block external access to JMX ports (typically 1099 and custom RMI ports). JMX should never be exposed to untrusted networks. Configure JMX authentication and SSL/TLS encryption where JMX access is required.
  4. Patch Apache Tomcat installations that use the JmxRemoteLifecycleListener, as CVE-2016-8735 is directly related to this Oracle vulnerability. Upgrade Tomcat to 6.0.48, 7.0.73, 8.0.39, 8.5.7, or 9.0.0.M12 or later.
  5. Audit JMX exposure across all environments by scanning for open JMX ports using tools like nmap and reviewing application configurations. Monitor logs for suspicious JMX connections and implement network segmentation to isolate Java application servers from untrusted network segments.

Technical Details

Vulnerability mechanism: CVE-2016-3427 is an unspecified vulnerability in the JMX (Java Management Extensions) component of Oracle Java SE, Java SE Embedded, and JRockit. The flaw relates to improper access control (CWE-284) in how JMX handles credential types, which allows unauthenticated remote attackers to interact with the JMX interface and execute arbitrary operations. Exploitation technique: An attacker targeting a JMX port exposed to the network can exploit this vulnerability without any credentials, leveraging the improper credential type handling to gain full control over the Java runtime and the underlying system. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the worst-case scenario of a network-accessible, trivially exploitable vulnerability that achieves complete system compromise. Downstream impact: This vulnerability has significant implications beyond direct Java SE deployments. Apache Tomcat's JmxRemoteLifecycleListener was not updated to incorporate Oracle's credential type fix, resulting in the related CVE-2016-8735 vulnerability. Apache Cassandra developers also discussed the impact on JMX-enabled Cassandra nodes, highlighting the cross-product nature of this JMX security flaw.

Frequently Asked Questions

Is CVE-2016-3427 being actively exploited?

Yes, CVE-2016-3427 is confirmed to be actively exploited in the wild. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of June 2, 2023. The EPSS score of 93.6% (99th percentile) indicates near-certain exploitation, making this one of the most actively targeted Java vulnerabilities.

What products are affected by CVE-2016-3427?

CVE-2016-3427 affects Oracle Java SE 6u113, 7u99, and 8u77, Java SE Embedded 8u77, and JRockit R28.3.9. Numerous downstream products are also affected, including Oracle Linux, Debian, Ubuntu, NetApp storage management products (E-Series SANtricity, OnCommand suite), and Apache Tomcat deployments using JmxRemoteLifecycleListener.

How do I fix CVE-2016-3427?

Upgrade to Oracle Java SE 6u121, 7u111, 8u101 or later from Oracle's April 2016 Critical Patch Update. Apply vendor-specific patches for your operating system distribution. Additionally, restrict JMX port access through firewall rules and ensure JMX authentication is properly configured. See the Remediation section for detailed guidance.

How severe is CVE-2016-3427?

CVE-2016-3427 carries a CVSS v3.1 base score of 9.8 (Critical), the highest severity rating, reflecting unauthenticated remote code execution capability with complete impact on confidentiality, integrity, and availability. The EPSS percentile of 99.8% places it among the most dangerous known vulnerabilities. Immediate patching and JMX port restriction are essential.

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score92.33%
EPSS Percentile99.8%

Dates

PublishedApril 21, 2016
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch