CVE-2026-87294

A flaw was found in OpenJDK. An unauthenticated remote attacker can exploit this issue across multiple network protocols by submitting crafted requests to application programming interfaces (APIs) within the Security component. Successful exploitation allows an attacker to modify or delete accessible application data, as well as gain unauthorized read access to sensitive information.

This vulnerability is rated Moderate because, although it can be triggered over the network without authentication, the scope of impact is restricted to partial confidentiality and integrity compromise of data handled by the running Java process rather than complete system takeover. Enterprise deployments of Red Hat products running OpenJDK services are primarily at risk when applications process untrusted network traffic and rely on the core Security component for certificate name verification. Applications that do not accept external connections or perform custom certificate validation remain unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.