9.8Critical KEV Used in ransomware

CVE-2012-4681Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

oracle jdk; oracle jre; redhat enterprise linux desktop; redhat enterprise linux eus Published: 2012-08-28 03:00 (14 years ago)

Known exploited — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.03.2022. Remediation deadline for US federal agencies: 24.03.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2012-4681

Description

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Weakness (CWE): CWE-284

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
oracle	jdk	1.6.0
oracle	jre	1.6.0
redhat	enterprise linux desktop	6.0
redhat	enterprise linux eus	6.3
redhat	enterprise linux server	6.0
redhat	enterprise linux workstation	6.0

References and patches

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html Third Party Advisory
SUSE-SU-2012:1398 vendor-advisoryMailing List
SUSE-SU-2012:1231 vendor-advisoryMailing List
TA12-240A third-party-advisoryThird Party AdvisoryUS Government Resource
http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/ Broken LinkExploit
SSRT100970 vendor-advisoryIssue TrackingMailing ListThird Party Advisory
https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day Broken LinkThird Party Advisory
http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html Broken LinkThird Party Advisory
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html Vendor Advisory
RHSA-2012:1225 vendor-advisoryThird Party Advisory
http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html ExploitThird Party Advisory
51044 third-party-advisoryNot Applicable
55213 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4681 US Government Resource

CPE matches (NVD) (60)

cpe:2.3:a:oracle:jdk:1.6.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update10:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update11:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update12:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update13:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update14:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update15:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update16:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update17:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update18:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update19:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update20:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update21:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update22:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update23:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update24:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update25:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update26:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update27:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update29:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update3:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update30:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update31:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update32:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update33:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update34:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update4:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update5:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update6:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update7:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update8:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.6.0:update9:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update3:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update4:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update5:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.7.0:update6:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:-:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update1:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update10:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update11:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update12:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update13:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update14:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update15:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update16:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update17:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update18:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update19:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update2:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update20:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update21:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update22:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update23:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update24:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.6.0:update25:*:*:*:*:*:*

CVSS score

9.8Critical

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	9.8Critical
nvd	CVSS 3.1	9.8Critical
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Critical
nvd	CVSS 2.0	10.0High

EPSS (chance of exploitation in 30 days)

98.54%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: yes
Technical impact: total

Timeline

ID reserved2012-08-27
Published2012-08-28 03:00
Reached IP-DB2026-10-24 23:34
Added to KEV2022-03-03
Last updated2026-08-06 08:16

Assigned by (CNA): mitre
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Java SE / OpenJDK

9.1Critical

CVE-2026-114820 21 days ago

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.…

9.1Critical

CVE-2026-91403 24 days ago

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1;…

4.8Medium

CVE-2026-91487 25 days ago

Oracle Corporation Oracle Java SE

Vulnerability in Oracle Java SE (component: Compiler). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21…

7.5High

CVE-2026-91484 25 days ago

Oracle Corporation Oracle Java SE

Vulnerability in Oracle Java SE (component: Java plugin). Supported versions that are affected are Oracle Java SE: 8u503 and 8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE …

5.9Medium

CVE-2026-91462 25 days ago

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1,…

5.3Medium

CVE-2026-91463 25 days ago

Oracle Corporation Oracle Java SE; Oracle Corporation Oracle GraalVM for JDK; Oracle Corporation Oracle GraalVM Enterprise Edition