Skip to content
COOEY

FAIL › dossier

Java SE

PRODUCT

· dossier confidence 20%

Oracle Java SE has a history of critical security vulnerabilities, frequently exploited by ransomware, raising concerns about its security posture and potential impact on DIB organizations. The consistent presence of RCE vulnerabilities and their exploitation necessitate immediate attention and remediation. This poses a significant risk to compliance with CMMC requirements.

Failure events
7
Zero-days
0
RCEs
6
On KEV
7
Critical
4
Worst shame
85
PROFILE
CategorySoftwareWhat they doOracle Java SE is a widely used Java Runtime Environment. It provides a platform for developing and running Java applications. Websitehttps://www.oracle.com/java/ ↗
SECURITY POSTURE

Oracle Java SE has a history of critical vulnerabilities and associated exploitation, indicating a potential weakness in security practices and patching cadence. Repeated exploitation of vulnerabilities by ransomware actors highlights a significant risk.

Notable failures
  • CVE-2013-2465 (RCE) linked to ransomware
  • CVE-2012-1723 (RCE) actively exploited
  • CVE-2012-4681 (RCE) exploited in ransomware attacks
  • CVE-2012-0507 (RCE) targeted by ransomware
  • CVE-2015-2590 (RCE)
  • Default security properties configuration allowed unrestricted access
  • CVE-2015-4902 (Integrity affectation)
Patterns: Repeated critical remote code execution (RCE) vulnerabilities; Active exploitation by ransomware actors; Delayed patching of critical systems; Default configuration issues leading to security risks
FAILURE HISTORY · 7
DATEEVENTSEVSUMMARY
2022-03-28 CVE-2012-5076 high Oracle Java SE shipped with default configurations allowing sandbox bypass via untrusted applets, enabling arbitrary code execution.
2022-03-03 CVE-2015-4902 high Oracle Java SE suffered an integrity vulnerability that was actively exploited in the wild, highlighting the severe risks of unpatched legacy software.
2022-03-03 CVE-2015-2590 high Oracle Java SE contained an unpatched remote code execution vulnerability that was actively exploited in the wild.
2022-03-28 CVE-2013-2465 critical Oracle Java SE vulnerabilities are actively exploited and linked to ransomware attacks, demonstrating a persistent risk for DIB organizations using outdated Java installations.
2022-03-03 CVE-2012-1723 critical A critical, actively exploited Java vulnerability allows remote code execution, impacting systems using outdated Java SE Runtime Environments (JRE).
2022-03-03 CVE-2012-0507 critical Oracle Java SE's Concurrency component had a remotely exploitable arbitrary code execution vulnerability, actively targeted by ransomware actors, highlighting the risk of outdated software in DIB environments.
2022-03-03 CVE-2012-4681 critical Oracle Java SE allowed remote code execution via a known vulnerability actively exploited in ransomware attacks, demonstrating a failure to patch critical systems promptly.
DOSSIER SOURCES
Open questions: What is the current status of the identified vulnerabilities? · What remediation steps have been taken to address the identified security weaknesses? · What is Oracle's vulnerability disclosure and patching process?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-20 04:55:02.359391+00:00