CVE-2016-3458

What it actually does

Remote attacker can alter data or application state through unspecified CORBA-related vectors in affected Java runtimes without requiring authentication or user interaction beyond visiting a crafted page.

Why it matters to the business

Older Java deployments risk silent modification of processed data or behavior, eroding trust in applications that rely on those runtimes; the issue is long-public and affects widely deployed enterprise software.

How an attack unfolds

An attacker sends a specially crafted CORBA message or applet to a vulnerable Java SE or Embedded instance; the flaw allows integrity impact without further privileges, potentially leading to altered program execution or data.

How to fix it

Upgrade Oracle JDK, JRE, and Java SE Embedded to versions newer than 6u115, 7u101, 8u92, and 8u91 respectively; apply current Oracle Critical Patch Updates and remove or restrict CORBA usage where feasible.

How to confirm the fix worked

Inventory all Java installations and compare reported versions against the vulnerable list; test applications with updated runtimes to confirm CORBA functionality behaves without the prior integrity exposure.

Typical attack path

1. Identify a target application or service using vulnerable Oracle Java SE/Embedded version
2. Craft or obtain a malicious CORBA payload or applet
3. Deliver the payload via network (e.g., web page or direct CORBA call)
4. Trigger the integrity violation in the target Java process

How to detect it

Review web and application server logs for unexpected CORBA traffic or applet loads targeting legacy Java versions; correlate with process execution anomalies in Java runtimes.

What your security team should do

• Prioritize replacement of any remaining Java 6/7/8 instances matching the vulnerable update levels
• Disable or sandbox CORBA interfaces in legacy applications
• Include Java version checks in regular asset scanning and patch management processes