Intel

CVE-2016-3427

Oracle Java SE and JRockit — Oracle Java SE and JRockit Unspecified Vulnerability

criticalKEV: actively exploitedPoCEPSS 92%

Description

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

Source: CISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-3427 carries an EPSS score of 92.3 % (99.8th percentile), reflecting the high real-world exploitation probability against the large installed base of unpatched legacy JVM deployments — particularly JRockit instances embedded in Oracle WebLogic environments, which are common in KRITIS and financial-sector organisations. The vulnerability allows unauthenticated remote attackers to achieve full CIA impact via the JMX interface, making it effectively a pre-auth remote code execution primitive when JMX ports are reachable. CISA added it to KEV in May 2023, seven years after the patch was released, because organisations continue to run unpatched Java middleware; any environment with internet-exposed or laterally reachable JMX ports, or with Java Web Start still enabled, should treat this as critical and prioritise patching and JMX hardening above lower-EPSS items in the current sprint.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the patch: The Oracle Critical Patch Update April 2016 (CPU April 2016) contains the fix. Target versions: Java SE 6u115+, 7u101+, 8u91+, Java SE Embedded 8u91+, JRockit R28.3.10+. Verify exact patch IDs in the Oracle CPU April 2016 advisory and deploy immediately.
  • Disable remote JMX: Remove or set to false the JVM startup flag com.sun.management.jmxremote on all affected JVM instances where remote management is not operationally required.
  • Block JMX ports at the firewall: Close TCP 1099 (RMI registry) and all dynamically assigned RMI ports at both perimeter and host-based firewalls — especially inbound from untrusted network segments.
  • Disable Java Web Start and browser applets: Set deployment.webjava.enabled=false in deployment.properties; uninstall or block the Java browser plugin via GPO or MDM policy.
  • Inventory all JVM instances: Enumerate every JVM deployment — application servers (WebLogic, JBoss, Tomcat), CI/CD agents, middleware — and flag instances running Java SE 6u113, 7u99, 8u77, or JRockit R28.3.9 for immediate remediation.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Restrict JMX traffic exclusively to dedicated management VLANs; enforce ACLs so only authorised management hosts can reach JMX endpoints (zero-trust principle).
  • Enforce JMX authentication and TLS: Where JMX is operationally required, set com.sun.management.jmxremote.authenticate=true and com.sun.management.jmxremote.ssl=true; rotate any weak passwords in jmxremote.password.
  • IPS/WAF rule for RMI serialisation: Detect and block inbound RMI serialisation streams (magic bytes AC ED 00 05) on exposed ports — example Snort/Suricata rule: alert tcp any any -> $SERVERS 1099 (msg:"RMI Serialization Stream"; content:"|AC ED 00 05|"; sid:9000001;).
  • Least-privilege JVM service accounts: Run JVM services under dedicated, non-privileged OS accounts; enable the Java SecurityManager with a restrictive policy file as an additional barrier.
  • Deserialisation filter: On Java 9+ configure jdk.serialFilter; for older versions deploy a deserialisation firewall library (e.g. SerialKiller) as a wrapper to reject unexpected class types.

Runbook · Step 3

Detection rules

  • Network telemetry (Zeek/Suricata): Alert on connections to TCP 1099 or dynamic RMI ports from external or non-authorised source IPs containing the RMI magic bytes |AC ED 00 05| — strong indicator of serialisation-based JMX attack attempts.
  • Process ancestry (EDR/Sysmon EID 1): Unexpected child processes spawned by java.exe or javaw.exe — e.g. cmd.exe, powershell.exe, sh, bash — indicate post-exploitation following JMX compromise. Sigma shape: ParentImage|endswith: 'java.exe' AND Image|endswith: ('cmd.exe','powershell.exe','sh','bash').
  • JVM startup parameter audit (Linux auditd): auditctl -a always,exit -F arch=b64 -S execve -F exe=/usr/bin/java — review logs for processes launched with -Dcom.sun.management.jmxremote but without ssl=true or authenticate=true.
  • Windows Event Log (EID 4688 / Sysmon EID 1): New processes whose command line contains jmxremote combined with authenticate=false or ssl=false — KQL snippet: process_command_line has "jmxremote" and (process_command_line has "authenticate=false" or process_command_line has "ssl=false").
  • Web server access logs: HTTP requests fetching JNLP files (.jnlp) or applet JARs from unknown external origins — patterns: GET .*\.jnlp or GET .*applet.*\.jar from external IP ranges.

Metrics

Severity
critical
Priority score
163.28
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
92.3 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2023-05-12 00:00 UTC
CWE
—

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-3427