CVE DatabaseCVE-2016-3427

Updated 2026-06-17한국어 권고문 →

CVE-2016-34279.8/CRITICALCISA KEVCWE-284

Oracle Java SE and JRockit JMX Remote Code Execution (RCE) Vulnerability Advisory (CVE-2016-3427)

⚡ Jump to Patch

Affected Vendors

oracle

Affected Components

java_se, java_se_embedded, jrockit

Published Date

2016-04-21

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

92.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9

Impact

Remote attackers can execute arbitrary code without authentication by sending malicious serialized objects to the JMX service port, leading to complete system compromise

Mitigation

Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS

Affected Products & Version Scope

Oracle Java SE 6u113, 7u99, 8u77 and earlier / Java SE Embedded 8u77 and earlier / JRockit R28.3.9 and earlier

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The most effective remediation is upgrading to the latest patched version of Java SE. Use the following commands to update Java via system package managers:

bash

# For Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade openjdk-8-jdk -y

# For RedHat/CentOS-based systems
sudo yum update java-1.8.0-openjdk-devel -y

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict JMX remote access to localhost or enforce strict authentication and SSL/TLS by modifying the JVM startup options (JAVA_OPTS):

bash

# Restrict JMX to local-only and enforce authentication/SSL
export JAVA_OPTS='-Dcom.sun.management.jmxremote.port=1099 \
                  -Dcom.sun.management.jmxremote.local.only=true \
                  -Dcom.sun.management.jmxremote.authenticate=true \
                  -Dcom.sun.management.jmxremote.ssl=true'

3. Log Audit & IoC Verification Commands

Use the following commands to inspect running Java processes for insecure JMX configurations and verify the installed Java version:

bash

# Check for running Java processes with insecure JMX configurations
ps -ef | grep java | grep -E 'jmxremote.port|jmxremote.authenticate=false'

# Verify the current Java version
java -version

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Snyk Open Source & Container Security

Due to active exploitation in the wild, immediately upgrade Java to the latest secure release and restrict external access to JMX ports.

Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds

Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.

Free Forever Tier · 1-Click GitHub/GitLab Auto-PR

Scan Your Git Repositories for Free

Master DevSecOps: Automated SAST/SCA in GitHub Actions & Kubernetes

View Course Curriculum

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2016-3427) is a critical remote code execution (RCE) flaw residing in the JMX (Java Management Extensions) component of Oracle Java SE, Java SE Embedded, and JRockit. JMX provides standard APIs for managing and monitoring Java applications, but by default, it lacks proper validation of untrusted inputs during remote connection handling. Specifically, the JMX RMI (Remote Method Invocation) connector deserializes incoming objects sent by clients. If vulnerable gadget chains exist on the classpath, this deserialization process triggers arbitrary code execution within the context of the Java Virtual Machine (JVM).

2. Exploitation Mechanics & Attack Scenario

An attacker begins by scanning target environments for exposed JMX service ports (typically port 1099 or other configured RMI registry ports). If the port is accessible and authentication is disabled or weak, the attacker crafts a malicious payload containing serialized objects (e.g., using gadget chains like Apache Commons Collections via tools like ysoserial). When this payload is transmitted to the JMX RMI connector, the target JVM deserializes the stream, executing the embedded system commands. This attack requires no user interaction and can be executed completely unauthenticated.

3. Infrastructure & Business Impact

With a CVSS 3.1 score of 9.8 (Critical) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability poses an extreme risk to enterprise infrastructure. Successful exploitation grants the attacker shell access with the privileges of the running Java process. This can lead to credential theft, lateral movement within the internal network, deployment of ransomware, and severe business disruption.

Official Vendor Advisories & References

NVD Original English Description

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.html

Source: secalert_us@oracle.com · Mailing List, Third Party Advisory

Frequently Asked SecOps Questions (CVE-2016-3427)

FAQ

Q1. How critical is CVE-2016-3427 and is it actively exploited in the wild?

CVE-2016-3427 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 92.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2016-3427?

Primary impacted vendors include oracle across java_se, java_se_embedded, jrockit. Scope summary: Oracle Java SE 6u113, 7u99, 8u77 and earlier / Java SE Embedded 8u77 and earlier / JRockit R28.3.9 and earlier

Q3. What temporary mitigations or workarounds exist for CVE-2016-3427 before patching?

[Mitigation] Apply the latest Oracle Java SE security updates, restrict external access to JMX ports, and enforce robust authentication and SSL/TLS Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION