CVE-2017-3241

CRITICAL

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).

Published: Jan 27, 2017 Modified: Jun 17, 2026

CWE-20

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: HIGH Privileges Required: NONE User Interaction: NONE Scope: CHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Products (9)

Vendor	Product	Version
oracle	jdk	1.6
oracle	jdk	1.7
oracle	jdk	1.8
oracle	jdk	1.8
oracle	jre	1.6
oracle	jre	1.7
oracle	jre	1.8
oracle	jre	1.8
oracle	jrockit	r28.3.12

GitHub Security Advisory GHSA-j64j-5jrj-hggj

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent...

References (38)

Risk Scores

CVSS Score 9.0 / 10

EPSS Score 32.84%

Top 2% most likely to be exploited

Threat Score 45.9 / 100

Data Sources

NVD EPSS GitHub