Is CVE-2016-3427 being actively exploited?

Yes. CVE-2016-3427 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on May 12, 2023.

What is the CVSS score for CVE-2016-3427?

CVE-2016-3427 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2016-3427

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 92.3%EU EUVD: exploited

Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-284
EPSS score: 92.3% (100th percentile)
In CISA KEV: Yes, added May 12, 2023
In EU EUVD: Yes (EUVD-2016-4453)
Published: April 21, 2016
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Oracle Java SE and JRockit Unspecified Vulnerability

Added to the KEV catalog on May 12, 2023; federal remediation due June 2, 2023.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2016-4453 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

apache / cassandra
apache / cassandra
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
netapp / e-series santricity management plug-ins
netapp / e-series santricity storage manager
netapp / e-series santricity web services
netapp / oncommand balance
netapp / oncommand cloud manager
netapp / oncommand insight
netapp / oncommand performance manager
netapp / oncommand report
netapp / oncommand shift
netapp / oncommand unified manager
netapp / oncommand unified manager
netapp / oncommand workflow automation
netapp / storagegrid
netapp / vasa provider for clustered data ontap
netapp / virtual storage console
opensuse / leap
opensuse / opensuse
opensuse / opensuse
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jre
oracle / jre
oracle / jre
oracle / jrockit
oracle / linux
oracle / linux
oracle / linux
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server
redhat / enterprise linux server aus
redhat / enterprise linux server aus

and 28 more…

Certified products that may be affected

33 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Oracle Linux 7 NSS Cryptographic Module - Oracle Corporation - FIPS 140 4586 - historical
Oracle Linux 7 Libreswan Cryptographic Module - Oracle Corporation - FIPS 140 4266 - historical
Oracle Linux 7 OpenSSH Client Cryptographic Module - Oracle Corporation - FIPS 140 4206 - historical
Oracle Linux 7 OpenSSH Server Cryptographic Module - Oracle Corporation - FIPS 140 4176 - historical
Oracle Linux 7 Unbreakable Enterprise Kernel (UEK 6) Cryptographic Module - Oracle Corporation - FIPS 140 4169 - historical

See all 33 in the Security Certifications Explorer.

References

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00006.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00009.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00012.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00021.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00022.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00026.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00027.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00039.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00040.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00042.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00058.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00059.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00061.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00067.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00002.html(Mailing List, Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0650.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0651.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0675.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0676.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0677.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0678.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0679.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0701.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0702.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0708.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0716.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-0723.html(Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2016-1039.html(Third Party Advisory)
http://www.debian.org/security/2016/dsa-3558(Mailing List, Third Party Advisory)
http://www.openwall.com/lists/oss-security/2020/08/31/1(Mailing List)
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html(Patch, Vendor Advisory)
http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html(Patch, Third Party Advisory)
http://www.securityfocus.com/bid/86421(Broken Link, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1035596(Broken Link, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id/1037331(Broken Link, Third Party Advisory, VDB Entry)
http://www.ubuntu.com/usn/USN-2963-1(Third Party Advisory)
http://www.ubuntu.com/usn/USN-2964-1(Third Party Advisory)
http://www.ubuntu.com/usn/USN-2972-1(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2016:1430(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2017:1216(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain