CVE-2016-3427

CVE-2016-3427 is an improper access-control flaw (CWE-284) in the JMX (Java Management Extensions) component of Oracle Java SE 6u113, 7u99, and 8u77, Java SE Embedded 8u77, and JRockit R28.3.9. Because the flaw is network-exploitable without privileges or user interaction (CVSS 3.1: 9.8), a remote, unauthenticated attacker can trigger it by sending crafted traffic to JMX-related interfaces on systems running the affected runtimes. Successful exploitation affects confidentiality, integrity, and availability, i.e., effectively a full compromise of the affected Java process, enabling data theft, tampering, and denial of service. Anyone running the affected Java or JRockit versions is exposed, including Linux distributions that package the JDK/JRE and NetApp E-Series SANtricity and OnCommand products that bundle affected Java. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2023-05-12, confirming active exploitation, and its EPSS score (~92%, 100th percentile) indicates a very high probability of exploitation; no public proof-of-concept is known.

What to do: Upgrade Java SE/JDK/JRE to releases newer than 8u77, 7u99, and 6u113 (apply Oracle's April 2016 Critical Patch Update fixes or later, or current supported Java releases), move JRockit beyond R28.3.9, and update Java SE Embedded beyond 8u77; for NetApp E-Series and OnCommand products, apply the vendor's updated releases containing fixed Java. As an interim mitigation, restrict remote JMX access to trusted management networks and monitor for anomalous JMX/RMI connections. Patching is required under CISA KEV (apply updates per vendor instructions).