CVE-2012-5076

Oracle Java SE shipped with default configurations allowing sandbox bypass via untrusted applets, enabling arbitrary code execution.

The default Java security properties failed to restrict access to internal packages, allowing untrusted code to bypass sandbox restrictions and execute arbitrary commands. DIB organizations must ensure Java is patched and hardened, as this flaw was actively exploited in the wild and represents a severe, avoidable security oversight.

Shame score — Oracle shipped a widely used platform with default configurations that allowed sandbox bypass, a severe and avoidable flaw that was actively exploited in the wild.