Vulnerability record · CVE-2019-2996 · published 16 October 2019

CVE-2019-2996: Oracle jdk vulnerability

Oracle · Jdk

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u221; Java SE Embedded: 8u221. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java SE, Java SE Embedded accessible data as well as unauthorized read access to a subset of Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).

4.2 CVSS 3.1 Medium EPSS 2.2% · top 17.9%

4.2CVSS 3.1 base score, v2 4.0

2.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

14Affected product versions listed by NVD

12References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

14 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

NE Series Santricity Os Controller Netapp NE Series Santricity Storage Manager Netapp NE Series Santricity Unified Manager Netapp NE Series Santricity Web Services Proxy Netapp NOncommand Workflow Automation Netapp NSnapmanager Netapp

Jdk Oracle

Jre Oracle

Enterprise Linux Redhat

Enterprise Linux Desktop Redhat

Enterprise Linux Eus Redhat

Enterprise Linux Server Redhat

Enterprise Linux Workstation Redhat

Satellite Redhat

References

Link	Tags
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	PatchVendor Advisory
https://access.redhat.com/errata/RHSA-2019:4113	PatchThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:4115	PatchThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0006	PatchThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0046	PatchThird Party Advisory
https://security.netapp.com/advisory/ntap-20191017-0001/	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	PatchVendor Advisory
https://access.redhat.com/errata/RHSA-2019:4113	PatchThird Party Advisory
https://access.redhat.com/errata/RHSA-2019:4115	PatchThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0006	PatchThird Party Advisory
https://access.redhat.com/errata/RHSA-2020:0046	PatchThird Party Advisory
https://security.netapp.com/advisory/ntap-20191017-0001/	Third Party Advisory

Track CVE-2019-2996 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-46604Apache ActiveMQ OpenWire deserialization remote code executionThe Java OpenWire protocol marshaller in Apache ActiveMQ deserializes untrusted data, letting an attacker manipulate serialized class types so the br…KEVEPSS 100%analysed27 Oct 2023 9.8CVE-2016-3427Oracle Java SE JMX Improper Access Control VulnerabilityCVE-2016-3427 is an unspecified vulnerability in Oracle Java SE 6u113, 7u99, 8u77, Java SE Embedded 8u77, and JRockit R28.3.9, reached through vector…KEVEPSS 92%analysed21 Apr 2016 8.8CVE-2023-41993Apple WebKit improper check allows arbitrary code executionCVE-2023-41993 is a WebKit flaw where processing web content can lead to arbitrary code execution, addressed with improved checks. Apple states it is…KEVEPSS 24%analysed21 Sep 2023 8.1CVE-2018-11776Apache Struts namespace handling flaw enables remote code executionApache Struts 2.3 through 2.3.34 and 2.5 through 2.5.16 can execute remote code when alwaysSelectFullNamespace is enabled and results or url tags are…KEVEPSS 100%analysed22 Aug 2018 8.1CVE-2017-12617Apache Tomcat Default Servlet JSP upload leads to remote code executionApache Tomcat with HTTP PUT enabled (for example, the Default servlet readonly parameter set to false) allows an attacker to upload a JSP file throug…KEVEPSS 100%analysed4 Oct 2017 7.8CVE-2019-13272Linux kernel ptrace credential mishandling allows local root escalationThe Linux kernel before 5.1.17 mishandles credential recording in ptrace_link (kernel/ptrace.c) when a process creates a ptrace relationship, and als…KEVEPSS 52%analysed17 Jul 2019 10.0CVE-2015-3292Netapp oncommand workflow automation vulnerabilityThe installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, wh…EPSS 12%31 May 2015 9.8CVE-2023-38545curl SOCKS5 proxy handshake heap buffer overflowcurl contains a heap-based out-of-bounds write (CWE-787) in the SOCKS5 proxy handshake. When a host name longer than 255 bytes is passed for proxy-si…EPSS 79%analysed18 Oct 2023

Source: NIST National Vulnerability Database (record CVE-2019-2996), CISA KEV, FIRST EPSS (scores of 2026-10-13). This page is refreshed as NVD updates the record.