CVE-2016-5528: Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware (subcomponent: Security).

Security readout for executives and security teams

CVE-2016-5528 affects Oracle GlassFish Server 2.1.1, 3.0.1, and 3.1.2. An unauthenticated network attacker could potentially take over the GlassFish Server. Oracle rates the issue as CVSS 9.0, but notes exploitation is difficult. No cited source indicates known active exploitation. Exposure is most relevant where affected GlassFish versions are reachable over a network, especially if administrative or application services are accessible from untrusted networks. Organizations using Oracle Fusion Middleware should verify whether bundled or dependent GlassFish deployments include versions 2.1.1, 3.0.1, or 3.1.2. Treat as high-priority remediation for any reachable affected GlassFish deployment. The business risk is server takeover, but urgency should be balanced by Oracle's note that exploitation is difficult and the lack of cited active exploitation evidence. Mitigation focus: Review Oracle's January 2017 Critical Patch Update for applicable GlassFish Server guidance.; Upgrade or patch affected GlassFish Server versions according to Oracle guidance.; Restrict network access to GlassFish services to trusted management and application paths..

Prepared

Jun 13, 2026, 11:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.