CVE-2015-2590: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
Vulnerability summary
CVE-2015-2590 is a high (CVSS 10.0) vulnerability in Oracle Java SE. It is known to be exploited: CISA lists it, first on 03-03-2022. EPSS estimates a 25.47% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities.
Listed as exploited by CISA (03-03-2022)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 27 · Related 10Timeline
- 16-07-2015PublishedVulnerability first disclosed.
- 03-03-2022Added to CISA KEVExploitedOracle Java SE and Java SE Embedded Remote Code Execution Vulnerability
- 24-03-2022CISA remediation dueDeadline passedApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
25.47%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 25.47% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-03-2022
- Federal due date
- 24-03-2022
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2015-2590
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat13 products
- enterprise_linux_desktop5.0 | 6.0 | 7.0
- enterprise_linux_eus6.6 | 6.7 | 7.1 | 7.2 | 7.3 | 7.4 | 7.5
- enterprise_linux_for_ibm_z_systems6.0_s390x
- enterprise_linux_for_ibm_z_systems_eus6.7_s390x | 7.1_s390x | 7.2_s390x | 7.3_s390x | 7.4_s390x | 7.5_s390x
- enterprise_linux_for_power_big_endian6.0_ppc64 | 7.0_ppc64
Suse3 products
- linux_enterprise_debuginfo11:sp3 | 11:sp4
- linux_enterprise_desktop11:sp3 | 11:sp4 | 12
- linux_enterprise_server12
Oracle2 products
Ubuntu2 products
- openjdk-6< 6b36-1.13.8-0ubuntu1~14.04
- openjdk-7< 7u79-2.5.6-0ubuntu1.14.04.1
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.04
Debian1 product
- debian_linuxEOL7.0 | 8.0
Opensuse1 product
- opensuseEOL13.1 | 13.2
7 vendors · 23 products
References
31 links- www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlX Refsource CONFIRMPatchVendor AdvisoryREPORT
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 31 references
www.debian.org/security/2015/dsa-3316Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory- www.debian.org/security/2015/dsa-3339Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2590Government ResourceUS Government Resource