CVE-2017-3526: Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP).

Security readout for executives and security teams

This Java vulnerability can let an unauthenticated network attacker make affected Java runtimes hang or repeatedly crash. The documented impact is denial of service, not data theft or code execution. Business urgency depends on whether exposed services or legacy client technologies process attacker-controlled JAXP/XML data. Exposure is most likely in legacy Java services, web services, applets, or Java Web Start applications using affected runtimes and reachable by untrusted network input. Systems still running the listed Java versions are the priority. Modern runtimes outside the cited versions are not shown affected by the source bundle. Prioritize remediation where affected Java runtimes support internet-facing or business-critical services. This is an availability issue with high impact if triggered, but the cited CVSS attack complexity is high and no active exploitation evidence is provided. Mitigation focus: Identify and replace affected Oracle Java, Java Embedded, and JRockit versions.; Apply relevant Oracle, Red Hat, Debian, or Gentoo vendor updates.; Reduce untrusted network access to Java services parsing XML or JAXP input..

Prepared

Jun 13, 2026, 05:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.