CVE-2017-3526

highpriority · track · 25EPSS 0.038 · 90 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

3.84% (90th) EPSS

CVSS 7.1 · high

Is it mine?

14 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-28

Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 6u141, 7u131 and 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).

cvss

Technical severity, 0–10. One row per scoring source.

7.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.4–7.1

v2.07.1highAV:N/AC:M/Au:N/C:N/I:N/A:Cprimary · NVD / NIST USexploitability 8.6 · impact 6.9

v3.05.9mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 2.2 · impact 3.6

v2.07.1highAV:N/AC:M/Au:N/C:N/I:N/A:Csecondary · FSTEC (BDU) RU

v3.05.4mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284US

affected products (14)

Products and version ranges known to be affected.

Oracle Corporation Java≤ 8u121; Java SE Embedded: 8u121; JRockit: R28.3.13enisa_euvdEU
Oracle Corporation Java≤ 7u131enisa_euvdEU
Oracle Corporation Java≤ Java SE: 6u141enisa_euvdEU
Oracle Corp. Java Platform≤ 8u121fstec_bduRU
Oracle Corp. Java Platform≤ 7u131fstec_bduRU
Oracle Corp. Java Platform≤ 6u141fstec_bduRU
Oracle Corp. Jrockit≤ r28.3.13fstec_bduRU
oracle jdk= 1.6nvdUScpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*
oracle jdk= 1.7nvdUScpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*
oracle jdk= 1.8nvdUScpe:2.3:a:oracle:jdk:*:*:*:*:*:*:*:*
oracle jre= 1.6nvdUScpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*
oracle jre= 1.7nvdUScpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*
oracle jre= 1.8nvdUScpe:2.3:a:oracle:jre:*:*:*:*:*:*:*:*
oracle jrockit= r28.3.13nvdUScpe:2.3:a:oracle:jrockit:*:*:*:*:*:*:*:*

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2017-04-24modified 2026-06-17

references (38)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan