CVE-2016-3427 Oracle Java SE and JRockit Unspecified
Remote attackers can compromise confidentiality, integrity, and availability in Oracle Java SE via unspecified JMX vectors.
- Exploited in the wild
- Since 12 May 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-3427?
CVE-2016-3427 is a critical vulnerability in Canonical Ubuntu Linux, published on 21 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Weakness: CWE-284
Which versions are affected by CVE-2016-3427?
It affects 38 products.
Products include Apache Cassandra, Canonical Ubuntu Linux, Debian Debian Linux, Netapp E-Series Santricity Management Plug-Ins, Netapp E-Series Santricity Storage Manager, Netapp E-Series Santricity Web Services and 32 more.
How do I fix CVE-2016-3427?
Apply the vendor's patch. US federal agencies must fix it by 2 Jun 2023.
Is CVE-2016-3427 being exploited?
Yes. Attackers have exploited CVE-2016-3427 in the wild since at least 12 May 2023.
Other vulnerabilities in Canonical Ubuntu Linux
- CVE-2018-8016 Missing Authentication for Critical Function in Apache Cassandra
- CVE-2021-44521 Remote code execution for scripted UDFs
- CVE-2026-27314 Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
- CVE-2025-26467 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)
- CVE-2025-23015 Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Sources
Also known as GHSA-php4-mj74-f79r, MINI-4r4p-2v5h-frgv, MINI-8gv3-hp78-44rm, MINI-fhx5-4rgc-qg3c, MINI-g36q-j9fr-g6mx, MINI-prc8-548x-vvqp and 4 more.