CVE-2016-3427

Confirmed PUBLISHED

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect...

Oracle · Java SE

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.8 Critical

At a Glance

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

cisa java nessus_scanner

CVE Published: Apr 21, 2016
Exploitation Reported: May 12, 2023
CVSS: 9.8 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

openSUSE-SU-2016:1222 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006...
RHSA-2016:0677 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0677.html
SUSE-SU-2016:1299 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039...
RHSA-2016:1039 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-1039.html
RHSA-2016:0701 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0701.html

Show 54 more references

USN-2972-1 ubuntu.com · Vendor Advisory http://www.ubuntu.com/usn/USN-2972-1
SUSE-SU-2016:1303 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042...
SUSE-SU-2016:1475 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002...
openSUSE-SU-2016:1235 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012...
openSUSE-SU-2016:1262 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026...
SUSE-SU-2016:1300 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040...
RHSA-2016:0676 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0676.html
RHSA-2016:1430 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2016:1430
RHSA-2016:0708 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0708.html
RHSA-2016:0723 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0723.html
RHSA-2016:0651 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0651.html
SUSE-SU-2016:1378 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058...
SUSE-SU-2016:1248 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021...
SUSE-SU-2016:1379 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059...
USN-2964-1 ubuntu.com · Vendor Advisory http://www.ubuntu.com/usn/USN-2964-1
openSUSE-SU-2016:1230 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009...
SUSE-SU-2016:1458 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067...
GLSA-201606-18 security.gentoo.org · Vendor Advisory https://security.gentoo.org/glsa/201606-18
RHSA-2016:0716 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0716.html
openSUSE-SU-2016:1265 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00027...
USN-2963-1 ubuntu.com · Vendor Advisory http://www.ubuntu.com/usn/USN-2963-1
RHSA-2016:0675 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0675.html
SUSE-SU-2016:1250 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022...
SUSE-SU-2016:1388 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061...
RHSA-2016:0702 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0702.html
RHSA-2016:0679 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0679.html
RHSA-2017:1216 access.redhat.com · Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1216
DSA-3558 debian.org · Vendor Advisory http://www.debian.org/security/2016/dsa-3558
RHSA-2016:0678 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0678.html
RHSA-2016:0650 rhn.redhat.com · Vendor Advisory http://rhn.redhat.com/errata/RHSA-2016-0650.html
1037331 securitytracker.com · VDB Entry http://www.securitytracker.com/id/1037331
1035596 securitytracker.com · VDB Entry http://www.securitytracker.com/id/1035596
86421 securityfocus.com · VDB Entry http://www.securityfocus.com/bid/86421
[tomcat-dev] 20190319 svn commit: r1855831 [25/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/343558d982879bf88ec20dbf707f8c11...
[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/b8a1bf18155b552dcf9a928ba808cbad...
[tomcat-dev] 20190325 svn commit: r1856174 [22/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/388a323769f1dff84c9ec905455aa73f...
[tomcat-dev] 20190325 svn commit: r1856174 [24/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/b5e3f51d28cd5d9b1809f56594f2cf63...
[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/39ae1f0bd5867c15755a6f959b271ade...
[tomcat-dev] 20190413 svn commit: r1857494 [17/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/88855876c33f2f9c532ffb75bfee570c...
[tomcat-dev] 20190413 svn commit: r1857494 [16/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/845312a10aabbe2c499fca94003881d2...
[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/37220405a377c0182d2afdbc36461c47...
[tomcat-dev] 20190415 svn commit: r1857582 [17/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/3d19773b4cf0377db62d1e9328bf9160...
[tomcat-dev] 20190415 svn commit: r1857582 [19/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/6af47120905aa7d8fe12f42e8ff2284f...
[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/b84ad1258a89de5c9c853c7f2d3ad77e...
[tomcat-dev] 20200203 svn commit: r1873527 [23/30] - /tomcat/site/trunk/docs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r03c597a64de790ba42c167efacfa233...
[tomcat-dev] 20200213 svn commit: r1873980 [27/34] - /tomcat/site/trunk/docs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2...
[tomcat-dev] 20200213 svn commit: r1873980 [26/34] - /tomcat/site/trunk/docs/ lists.apache.org · Mailing List https://lists.apache.org/thread.html/r587e50b86c1a96ee301f751d5029407...
[cassandra-user] 20200831 CVE-2016-3427 Apache Cassandra Unspecified vulnerability related to JMX lists.apache.org · Mailing List https://lists.apache.org/thread.html/rc3abf40b06c511d5693baf707d6444b...
[cassandra-dev] 20200831 CVE-2016-3427 Apache Cassandra Unspecified vulnerability related to JMX lists.apache.org · Mailing List https://lists.apache.org/thread.html/r5f48b16573a11fdf0b557cc3d1d7142...
[oss-security] 20200831 CVE-2016-3427 Apache Cassandra Unspecified vulnerability related to JMX openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2020/08/31/1
oracle.com/technetwork/topics/security/linuxbulletinapr... oracle.com · CVE Record http://www.oracle.com/technetwork/topics/security/linuxbulletinapr201...
security.netapp.com/advisory/ntap-20160420-0001 security.netapp.com · CVE Record https://security.netapp.com/advisory/ntap-20160420-0001/
kc.mcafee.com/corporate/index kc.mcafee.com · CVE Record https://kc.mcafee.com/corporate/index?page=content&id=SB10159
oracle.com/technetwork/security-advisory/cpuapr2016v3-2... oracle.com · CVE Record http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-05-12 00:00 UTC

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation Status

Exploited in the wild

Recorded 2023-05-12 00:00:00 UTC · CISA

Weaknesses (CWE)

CWE-284

Improper Access Control

Scanner Integrations

Scanner	Reference	Detected
Nessus	https://www.tenable.com/plugins/nessus/160348	Jun 02, 2025

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2016-3427

{
  "cve_id": "CVE-2016-3427",
  "title": "Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Em...",
  "affected_vendor": "Oracle",
  "affected_product": "Java SE",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2016-3427

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Timeline

Automate This Intelligence with the Pro API