{"id":"CVE-2013-0422","published":"2013-01-10T21:55:00Z","modified":"2026-06-16T23:49:24Z","title":"Oracle JRE Remote Code Execution Vulnerability","vendor":"Oracle","product":"Java Runtime Environment (JRE)","tier":"core","eol":{"product":"Java SE 6/7","since":"2015-04-14","note":"No security updates; remove it."},"description":{"text":"Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114.  CVE-2013-0422 covers both the JMX/MBean and Reflection API issues.  NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks.  NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11.  If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.","provenance":"source","from":"NVD"},"summary":{"text":"The Oracle Java Runtime Environment (JRE) contains multiple flaws in Oracle Java 7 before Update 11, in the JMX MBean instantiation path (JmxMBeanServer.getMBeanInstantiator and findClass) and in the Reflection API's handling of security checks through MethodHandles.Lookup.checkSecurityManager and Reflection.getCallerClass. A remote attacker with no privileges and no user interaction beyond reaching the vulnerable Java code can execute arbitrary code, and the Reflection API vector is known to have been used in attacks.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:08Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.97024,"percentile":0.9989,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-0422","provenance":"source"},"vulncheckKev":{"dateAdded":"2013-01-10","exploitedFirstSeen":"2013-01-10","ransomware":true,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0422","date":"2013-01-10"},{"url":"https://cisa.gov/news-events/alerts/2013/01/10/oracle-java-7-security-manager-bypass-vulnerability","date":"2013-02-06"},{"url":"https://www.virusbulletin.com/virusbulletin/2013/04/java-security-era-byod","date":"2013-04-01"},{"url":"https://kung_foo.keybase.pub/papers_and_presentations/Unveiling_an_Indian_Cyberattack_Infrastructure.pdf","date":"2013-05-01"},{"url":"https://krebsonsecurity.com/2013/07/styx-exploit-pack-domo-arigato-pc-roboto/","date":"2013-07-08"},{"url":"https://securelist.com/the-icefog-apt-a-tale-of-cloak-and-three-daggers/57331/","date":"2013-09-25"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0603.pdf","date":"2020-06-03"},{"url":"https://cybersecurityworks.com/pdf/ransomware/Spotlight_Ransomware2021.pdf","date":"2021-02-11"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-25"}],"evidenceTotal":11,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-284","name":"Improper Access Control"},{"id":"CWE-264","name":null}],"references":[{"url":"http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html","tags":["Not Applicable"]},{"url":"http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/","tags":["Broken Link"]},{"url":"http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html","tags":["Third Party Advisory"]},{"url":"http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/","tags":["Third Party Advisory"]},{"url":"http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/","tags":["Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0156.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0165.html","tags":["Third Party Advisory"]},{"url":"http://seclists.org/bugtraq/2013/Jan/48","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/625617","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:095","tags":["Not Applicable"]},{"url":"http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html","tags":["Vendor Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1693-1","tags":["Third Party Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA13-010A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf","tags":["Broken Link"]},{"url":"https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013","tags":["Not Applicable"]},{"url":"https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018","tags":["Third Party Advisory"]},{"url":"https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us","tags":["Not Applicable"]},{"url":"http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html","tags":["Not Applicable"]},{"url":"http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/","tags":["Broken Link"]},{"url":"http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html","tags":["Third Party Advisory"]},{"url":"http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/","tags":["Third Party Advisory"]},{"url":"http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/","tags":["Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0156.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0165.html","tags":["Third Party Advisory"]},{"url":"http://seclists.org/bugtraq/2013/Jan/48","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/625617","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:095","tags":["Not Applicable"]},{"url":"http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html","tags":["Vendor Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1693-1","tags":["Third Party Advisory"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA13-010A.html","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf","tags":["Broken Link"]},{"url":"https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013","tags":["Not Applicable"]},{"url":"https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018","tags":["Third Party Advisory"]},{"url":"https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us","tags":["Not Applicable"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0422","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: drive-by browser exploit kits deliver the Java payload","mappingType":"uncategorized","evidence":[{"from":"description","quote":"as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack","start":604,"end":691}],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary code execution in the Java context","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allow remote attackers to execute arbitrary code","start":59,"end":107}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"CVE-2013-0422","start":102328,"end":102341},{"quote":" CVE-2013-0422 first appeared in January 2013 as a zero-day vulnerability.","start":105985,"end":106060},{"quote":"CVE-2013-0422 is a package access check vulnerability that allows an","start":106062,"end":106130},{"quote":"For more information about CVE-2013-0422, see the entry “A technical","start":106345,"end":106413},{"quote":"analysis of a new Java vulnerability (CVE-2013-0422)” (January 20, 2013) in","start":106415,"end":106490}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2013-0422","start":82524,"end":82537},{"quote":" CVE-2013-0422 first appeared in January 2013 as a zero-day vulnerability.","start":86628,"end":86703},{"quote":"CVE-2013-0422 is a package access check vulnerability that allows an","start":86705,"end":86773},{"quote":"For more information about CVE-2013-0422, see the entry “A technical","start":86988,"end":87056},{"quote":"analysis of a new Java vulnerability (CVE-2013-0422)” (January 20, 2013) in","start":87058,"end":87133}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2013-0433","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-0433","exploited":true,"exploitedSince":"2022-05-25","provenance":"source"},"exploits":[{"id":24045,"url":"https://www.exploit-db.com/exploits/24045","title":"Java Applet JMX - Remote Code Execution (Metasploit) (1)","type":"remote","platform":"java","date":"2013-01-11","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2013-01-11"},"metasploit":[{"name":"Java Applet JMX Remote Code Execution","module":"exploit/multi/browser/java_jre17_jmxbean","type":"exploit","disclosureDate":"2013-01-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb"}],"first":{"date":"2013-01-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1189","T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2013-01-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0422","provenance":"source"},{"date":"2013-01-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2013-01-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_jre17_jmxbean.rb","provenance":"source"},{"date":"2013-01-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2013-0422","provenance":"source"},{"date":"2022-05-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-0433","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":3422},"priority":{"score":71.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5040 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]}}