10

CVE-2012-1723: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

CVSS: 10.0v2.0HighKEVRansomwareAnalyzed
AliasesCGA-2xpm-c2qc-9rfjCGA-35jj-vq98-mjjcCGA-36gw-qfg3-crhx
Published 16-06-2012Last modified 06-08-2026
Open JSON

Vulnerability summary

CVE-2012-1723 is a high (CVSS 10.0) Improper Access Control vulnerability in Oracle Java SE. It is known to be exploited: CISA lists it, first on 03-03-2022. It has been used in ransomware campaigns. EPSS estimates a 93.57% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
100/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
High · v2.0 (NVD)
EPSS score
93.57%
0%100%
Critical · -0.12 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits2metasploit, exploit-database

Advisory lineage

Upstream 0 · Downstream 7 · Related 6
DSA-2507-1OPENSUSE-SU-2024:10534-1RHSA-2012:0729RHSA-2012:0730RHSA-2012:0734RHSA-2012:1009

Timeline

  1. 16-06-2012
    PublishedVulnerability first disclosed.
  2. 03-03-2022
    Added to CISA KEVOracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
  3. 24-03-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 06-08-2026
    Last modifiedVulnerability information updated.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

93.57%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.12 pp

From 93.69% on 21-09-2026

21-09-202621-10-2026
EPSS score
93.57%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
03-03-2022
Federal due date
24-03-2022
Ransomware

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2012-1723

Public exploits

2 found
  • MetasploitMetasploitremoteVerified

    Java Applet Field Bytecode Verifier Cache Remote Code Execution

    exploit/multi/browser/java_verifier_field_access

    Maturity: weaponized

  • exploit-databaseremotejavaVerified

    Java Applet - Field Bytecode Verifier Cache Remote Code Execution (Metasploit)

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Chainguard16 products
  • openjdk-11-openj9-default-policy< 0.53.0-r0
  • openjdk-17-openj9-default-policy< 0.53.0-r0
  • openjdk-21-openj9-default-policy< 0.48.0-r2
  • openjdk-25-openj9All versions (No fix recorded)
  • openjdk-25-openj9-dbgAll versions (No fix recorded)
Redhat6 products
Oracle2 products
  • jdk≤ 1.4.2_37 | 1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update30 | 1.5.0:update31 | 1.5.0:update32 | 1.5.0:update33 | 1.5.0:update34 | 1.5.0:update35 | 1.6.0 | 1.6.0:update1 | 1.6.0:update10 | 1.6.0:update11 | 1.6.0:update12 | 1.6.0:update13 | 1.6.0:update14 | 1.6.0:update15 | 1.6.0:update16 | 1.6.0:update17 | 1.6.0:update18 | 1.6.0:update19 | 1.6.0:update2 | 1.6.0:update20 | 1.6.0:update21 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update3 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.6.0:update32_b31 | 1.6.0:update32_b32 | 1.7.0 | 1.7.0:update1 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4
  • jre≤ 1.4.2_37 | 1.5.0 | 1.5.0:update1 | 1.5.0:update10 | 1.5.0:update11 | 1.5.0:update12 | 1.5.0:update13 | 1.5.0:update14 | 1.5.0:update15 | 1.5.0:update16 | 1.5.0:update17 | 1.5.0:update18 | 1.5.0:update19 | 1.5.0:update2 | 1.5.0:update20 | 1.5.0:update21 | 1.5.0:update22 | 1.5.0:update23 | 1.5.0:update24 | 1.5.0:update25 | 1.5.0:update26 | 1.5.0:update27 | 1.5.0:update28 | 1.5.0:update29 | 1.5.0:update3 | 1.5.0:update30 | 1.5.0:update31 | 1.5.0:update32 | 1.5.0:update33 | 1.5.0:update34 | 1.5.0:update35 | 1.6.0 | 1.6.0:update1 | 1.6.0:update10 | 1.6.0:update11 | 1.6.0:update12 | 1.6.0:update13 | 1.6.0:update14 | 1.6.0:update15 | 1.6.0:update16 | 1.6.0:update17 | 1.6.0:update18 | 1.6.0:update19 | 1.6.0:update2 | 1.6.0:update20 | 1.6.0:update21 | 1.6.0:update22 | 1.6.0:update23 | 1.6.0:update24 | 1.6.0:update25 | 1.6.0:update26 | 1.6.0:update27 | 1.6.0:update29 | 1.6.0:update3 | 1.6.0:update30 | 1.6.0:update31 | 1.6.0:update32 | 1.7.0 | 1.7.0:update1 | 1.7.0:update2 | 1.7.0:update3 | 1.7.0:update4

3 vendors · 24 products

References

11 links
Show all 11 references