CVE-2026-87290

A flaw was found in the Java API for XML Processing (JAXP) component of OpenJDK. An unauthenticated remote attacker could exploit this vulnerability by submitting specially crafted input to applications or web services that rely on vulnerable JAXP APIs. Successful exploitation can result in unauthorized information disclosure, allowing an attacker to access sensitive data managed by the Java application.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux and Red Hat OpenJDK distributions because exploitation depends on high attack complexity, requiring specific conditions where applications handle untrusted external XML data using vulnerable JAXP XPath evaluation routines. Standard installations do not expose these interfaces directly to the network without custom application logic or specific web services consuming external inputs. Furthermore, the potential impact is constrained to unauthorized information disclosure without enabling arbitrary command execution or system modification.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.