Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer).
Priority LOW 35Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Installer). Supported versions that are affected are Java SE: 8u152 and 9.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Java SE executes to compromise Java SE. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to the Windows installer only. CVSS 3.0 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00491 42nd percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:jdk:1.8.0:update152:*:*:*:*:*:* | 1.8.0 update152 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jdk:9.0.1:*:*:*:*:*:*:* | 9.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jre:1.8.0:update152:*:*:*:*:*:* | 1.8.0 update152 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jre:9.0.1:*:*:*:*:*:*:* | 9.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:* | 5.8 | Vulnerable | Red Hat |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* | 7.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* | 9.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0 – 11.70.1 | Vulnerable | NetApp |
- cpe:2.3:a:oracle:jdk:1.8.0:update152:*:*:*:*:*:* Versions 1.8.0 update152 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jdk:9.0.1:*:*:*:*:*:*:* Versions 9.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jre:1.8.0:update152:*:*:*:*:*:* Versions 1.8.0 update152 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jre:9.0.1:*:*:*:*:*:*:* Versions 9.0.1 Vulnerable ·Oracle
- cpe:2.3:a:redhat:satellite:5.8:*:*:*:*:*:*:* Versions 5.8 Vulnerable ·Red Hat
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_management_plug-ins:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.70.1 Vulnerable ·NetApp
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:* | 7.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:windows:*:* | 7.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:* | up to 9.0.4 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:* | 7.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:* | 7.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:virtual_storage_console:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | NetApp |
- cpe:2.3:a:netapp:e-series_santricity_storage_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:* Versions 7.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:windows:*:* Versions 7.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:storagegrid:*:*:*:*:*:*:*:* Versions up to 9.0.4 Vulnerable ·NetApp
- cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·NetApp
- cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vmware_vsphere:*:* Versions 7.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:virtual_storage_console:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·NetApp
Remediation
Red Hat 2 advisories
- RHSA-2018:1463 Released 2018-05-15 · Red Hat rating Moderatejava-1.8.0-ibm security update
- Red Hat Satellite 5.8 (RHEL v.6) java-1.8.0-ibm-1:1.8.0.5.10-1jpp.1.el6_9, java-1.8.0-ibm-devel-1:1.8.0.5.10-1jpp.1.el6_9
- RHSA-2018:0099 Released 2018-01-18 · Red Hat rating Criticaljava-1.8.0-oracle security update
- Oracle Java for Red Hat Enterprise Linux Client (v. 7) java-1.8.0-oracle-1:1.8.0.161-1jpp.2.el7, java-1.8.0-oracle-devel-1:1.8.0.161-1jpp.2.el7, java-1.8.0-oracle-javafx-1:1.8.0.161-1jpp.2.el7 +3
- Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) java-1.8.0-oracle-1:1.8.0.161-1jpp.2.el7, java-1.8.0-oracle-devel-1:1.8.0.161-1jpp.2.el7, java-1.8.0-oracle-javafx-1:1.8.0.161-1jpp.2.el7 +1
- Oracle Java for Red Hat Enterprise Linux Desktop 6 java-1.8.0-oracle-1:1.8.0.161-1jpp.1.el6_9, java-1.8.0-oracle-devel-1:1.8.0.161-1jpp.1.el6_9, java-1.8.0-oracle-javafx-1:1.8.0.161-1jpp.1.el6_9 +3
- Oracle Java for Red Hat Enterprise Linux HPC Node 6 java-1.8.0-oracle-1:1.8.0.161-1jpp.1.el6_9, java-1.8.0-oracle-devel-1:1.8.0.161-1jpp.1.el6_9, java-1.8.0-oracle-javafx-1:1.8.0.161-1jpp.1.el6_9 +3
- Oracle Java for Red Hat Enterprise Linux Server (v. 7) java-1.8.0-oracle-1:1.8.0.161-1jpp.2.el7, java-1.8.0-oracle-devel-1:1.8.0.161-1jpp.2.el7, java-1.8.0-oracle-javafx-1:1.8.0.161-1jpp.2.el7 +3
- Oracle Java for Red Hat Enterprise Linux Server 6 java-1.8.0-oracle-1:1.8.0.161-1jpp.1.el6_9, java-1.8.0-oracle-devel-1:1.8.0.161-1jpp.1.el6_9, java-1.8.0-oracle-javafx-1:1.8.0.161-1jpp.1.el6_9 +3
- Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) java-1.8.0-oracle-1:1.8.0.161-1jpp.2.el7, java-1.8.0-oracle-devel-1:1.8.0.161-1jpp.2.el7, java-1.8.0-oracle-javafx-1:1.8.0.161-1jpp.2.el7 +3
- Oracle Java for Red Hat Enterprise Linux Workstation 6 java-1.8.0-oracle-1:1.8.0.161-1jpp.1.el6_9, java-1.8.0-oracle-devel-1:1.8.0.161-1jpp.1.el6_9, java-1.8.0-oracle-javafx-1:1.8.0.161-1jpp.1.el6_9 +3
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Oracle Java for Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2018:0099 |
| Oracle Java for Red Hat Enterprise Linux Compute Node (v. 7) | Fixed | RHSA-2018:0099 |
| Oracle Java for Red Hat Enterprise Linux Desktop 6 | Fixed | RHSA-2018:0099 |
| Oracle Java for Red Hat Enterprise Linux HPC Node 6 | Fixed | RHSA-2018:0099 |
| Oracle Java for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2018:0099 |
| Oracle Java for Red Hat Enterprise Linux Server 6 | Fixed | RHSA-2018:0099 |
| Oracle Java for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2018:0099 |
| Oracle Java for Red Hat Enterprise Linux Workstation 6 | Fixed | RHSA-2018:0099 |
| Red Hat Satellite 5.8 (RHEL v.6) | Fixed | RHSA-2018:1463 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-2627
- 2026-10-03 Alias added: GHSA-x2mp-gcv7-74m4
References
Sources
- CVE-2018-2627 · CVE Program
- CVE-2018-2627 · NVD
- FIRST EPSS
- GHSA-x2mp-gcv7-74m4 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-2627 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences