{"id":"CVE-2012-4681","published":"2012-08-28T00:55:01Z","modified":"2026-08-06T05:16:34Z","title":"Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","vendor":"Oracle","product":"Java SE","tier":"core","eol":{"product":"Java SE 7","since":"2015-04-14","note":"No security updates; remove it."},"description":{"text":"Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using \"reflection with a trusted immediate caller\" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.","provenance":"source","from":"NVD"},"summary":{"text":"The Java Runtime Environment (JRE) component of Oracle Java SE 7 Update 6 and earlier contains multiple flaws that allow the SecurityManager sandbox to be bypassed through improper access control. A remote attacker can execute arbitrary code by luring a user into running a crafted applet, which requires no authentication and can be delivered over the network.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:30Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98536,"percentile":0.99921,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2012-4681","provenance":"source"},"vulncheckKev":{"dateAdded":"2012-08-28","exploitedFirstSeen":"2012-08-28","ransomware":true,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2012-4681","date":"2012-08-28"},{"url":"https://cisa.gov/news-events/alerts/2012/08/27/oracle-java-7-security-manager-bypass-vulnerability","date":"2013-01-23"},{"url":"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf","date":"2014-02-01"},{"url":"https://securelist.com/the-epic-turla-operation/65545/","date":"2014-08-07"},{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf","date":"2015-02-01"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0603.pdf","date":"2020-06-03"},{"url":"https://cybersecurityworks.com/pdf/ransomware/Spotlight_Ransomware2021.pdf","date":"2021-02-11"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.mandiant.com/sites/default/files/2021-09/rpt-java-vulnerabilities.pdf","date":"2021-09-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"}],"references":[{"url":"http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html","tags":["Third Party Advisory"]},{"url":"http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/","tags":["Broken Link","Exploit"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html","tags":["Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html","tags":["Mailing List"]},{"url":"http://marc.info/?l=bugtraq&m=135109152819176&w=2","tags":["Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1225.html","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/51044","tags":["Not Applicable"]},{"url":"http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/55213","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA12-240A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day","tags":["Broken Link","Third Party Advisory"]},{"url":"http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html","tags":["Third Party Advisory"]},{"url":"http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html","tags":["Exploit","Third Party Advisory"]},{"url":"http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/","tags":["Broken Link","Exploit"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html","tags":["Mailing List"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html","tags":["Mailing List"]},{"url":"http://marc.info/?l=bugtraq&m=135109152819176&w=2","tags":["Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2012-1225.html","tags":["Third Party Advisory"]},{"url":"http://secunia.com/advisories/51044","tags":["Not Applicable"]},{"url":"http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html","tags":["Broken Link","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html","tags":["Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/55213","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA12-240A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4681","tags":["US Government Resource"]}],"techniques":[{"id":"T1057","name":"Process Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: arbitrary code execution achieved through applet","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allow remote attackers to execute arbitrary code","start":114,"end":162}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: malicious applet delivered to victim browser","mappingType":"uncategorized","evidence":[{"from":"description","quote":"via a crafted applet that bypasses SecurityManager restrictions","start":163,"end":226}],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1480","name":"Execution Guardrails","tactics":["stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1497","name":"Virtualization/Sandbox Evasion","tactics":["discovery","stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-6455ab6c9917b3700d6d","title":"Version: 1.5","publisher":"media.kasperskycontenthub.com","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf","date":null,"mentions":[{"quote":"• CVE-2012-4681 (Java).","start":14728,"end":14751}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2012-4606","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-4606","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":20865,"url":"https://www.exploit-db.com/exploits/20865","title":"Java 7 Applet - Remote Code Execution (Metasploit)","type":"remote","platform":"java","date":"2012-08-27","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2012-08-27"},"pocGithub":{"count":2,"skipped":0,"earliest":"2014-09-26","earliestUrl":"https://github.com/benjholla/CVE-2012-4681-Armoring","repos":[{"name":"benjholla/CVE-2012-4681-Armoring","url":"https://github.com/benjholla/CVE-2012-4681-Armoring","stars":1,"created":"2014-09-26"},{"name":"ZH3FENG/PoCs-CVE_2012_4681","url":"https://github.com/ZH3FENG/PoCs-CVE_2012_4681","stars":0,"created":"2018-01-05"}]},"metasploit":[{"name":"Java 7 Applet Remote Code Execution","module":"exploit/multi/browser/java_jre17_exec","type":"exploit","disclosureDate":"2012-08-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_exec.rb"}],"first":{"date":"2012-08-26","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_exec.rb"},"provenance":"source"},"exploitRefs":["http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html","http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/"],"flow":[{"stage":"related","techniques":["T1059"],"provenance":"source"},{"stage":"related","techniques":["T1189","T1068","T1480","T1497","T1057"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2012-08-26","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2012-08-27, PoC-in-GitHub 2014-09-26","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_exec.rb","provenance":"source"},{"date":"2012-08-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4681","provenance":"source"},{"date":"2012-08-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2012-4681","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-4606","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3474},"priority":{"score":68.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5175 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-oracle-java-se-cwe-284"}}