WaratekVRT Sign in

CVE-2016-3427 Oracle JRockit

Affected softwareOracle JRockit
Severity9.8 Critical CVSS 3.1 3 scores
WeaknessImproper access control (CWE-284)
Published21 Apr 2016
Updated29 Sep 2026

Description

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2023-05-12 · remediation due 2023-06-02 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 3 citations · earliest 2023-05-12.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC none indexed
  • EPSS 92% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2016-3427 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2023-05-12
Reported exploitation thedfirreport.com /2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity 2023-12-18
Reported exploitation fortinet.com /content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf 2024-05-06

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the Marshal RCE rule, ARMR Process rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: Marshal RCE rule, ARMR Process rule

Pre-auth native deserialization of the JMX RMI newClient credentials object; Marshal deserialize(java)+rce() intercepts the gadget at ObjectInputStream.readObject(), and the Process rule (with /bin/* in its execute list) blocks the gadget's Runtime.exec.

How to mitigate CVE-2016-3427

Apply the vendor's fix for Oracle JRockit. Until you can, Waratek RASP blocks exploitation with its deserialization and process rules. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 10.0 none AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update April 2016 ↗ CPU 2016-Q2 Oracle Java SE / JMX (Java SE: 6u113, 7u99, 8u77; Java SE Embedded: 8u77; JRockit: R28.3.9)
Oracle's note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Java SE JMX Java SE: 6u113, 7u99, 8u77; Java SE Embedded: 8u77; JRockit: R28.3.9 6.0.113.0 · 7.0.99.0 · 8.0.77.0

Products and versions

38 products, 80 version entries
SourceVendorProductSchemeAffected versions
nvd apache cassandra generic ≥ 2.1.0 and ＜ 2.1.22 · ≥ 2.2.0 and ＜ 2.2.18 · ≥ 3.0.0 and ＜ 3.0.22 · ≥ 3.11.0 and ＜ 3.11.8 · 4.0.0:beta1
nvd canonical ubuntu linux generic 12.04 · 14.04 · 15.10 · 16.04
nvd debian debian linux generic 8.0
nvd netapp e-series santricity management plug-ins generic any version
nvd netapp e-series santricity storage manager generic any version
nvd netapp e-series santricity web services generic any version
nvd netapp oncommand balance generic any version
nvd netapp oncommand cloud manager generic any version
nvd netapp oncommand insight generic any version
nvd netapp oncommand performance manager generic any version
nvd netapp oncommand report generic any version
nvd netapp oncommand shift generic any version
nvd netapp oncommand unified manager generic any version
nvd netapp oncommand workflow automation generic any version
nvd netapp storagegrid generic ≤ 9.0.4
nvd netapp vasa provider for clustered data ontap generic ≥ 7.2
nvd netapp virtual storage console generic ≥ 7.2
nvd opensuse leap generic 42.1
nvd opensuse opensuse generic 13.1 · 13.2
nvd oracle jdk javase 1.6.0:update113 · 1.7.0:update99 · 1.8.0:update77
nvd oracle jre javase 1.6.0:update113 · 1.7.0:update99 · 1.8.0:update77
nvd oracle jrockit generic r28.3.9
nvd oracle linux generic 5 · 6 · 7
nvd redhat enterprise linux desktop generic 5.0 · 6.0 · 7.0
nvd redhat enterprise linux eus generic 6.7 · 7.2 · 7.3 · 7.4 · 7.5 · 7.6 · 7.7
nvd redhat enterprise linux server generic 5.0 · 6.0 · 7.0
nvd redhat enterprise linux server aus generic 7.2 · 7.3 · 7.4 · 7.6 · 7.7
nvd redhat enterprise linux server eus generic 6.7 · 7.2
nvd redhat enterprise linux server tus generic 7.2 · 7.3 · 7.6 · 7.7
nvd redhat enterprise linux workstation generic 5.0 · 6.0 · 7.0
nvd redhat satellite generic 5.6 · 5.7
nvd suse linux enterprise desktop generic 12 · 12:sp1
nvd suse linux enterprise module for legacy generic 12
nvd suse linux enterprise server generic 10:sp4 · 11:sp2 · 11:sp3 · 11:sp4 · 12 · 12:sp1
nvd suse linux enterprise software development kit generic 11:sp4 · 12:sp1
nvd suse manager generic 2.1
nvd suse manager proxy generic 2.1
nvd suse openstack cloud generic 5

References

URLTags
https://access.redhat.com/errata/RHSA-2016:0650 ADVISORY, RHSA-2016:0650
https://access.redhat.com/security/cve/CVE-2016-3427 REPORT, RHSA-2016:0650
https://access.redhat.com/errata/RHSA-2016:0651 ADVISORY, RHSA-2016:0651
https://access.redhat.com/errata/RHSA-2016:0675 ADVISORY, RHSA-2016:0675
https://access.redhat.com/errata/RHSA-2016:0676 ADVISORY, RHSA-2016:0676
https://access.redhat.com/errata/RHSA-2016:0677 ADVISORY, RHSA-2016:0677
https://access.redhat.com/errata/RHSA-2016:0716 ADVISORY, RHSA-2016:0716
https://access.redhat.com/errata/RHSA-2016:0723 ADVISORY, RHSA-2016:0723
https://access.redhat.com/errata/RHSA-2016:1039 ADVISORY, RHSA-2016:1039
https://www.oracle.com/security-alerts/cpuapr2016v3.html

Timeline
Published2016-04-21By the CVE Program.
Added to CISA KEV2023-05-12Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2023-05-12Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
VulnCheck KEV: latest evidence2024-05-06Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.