WaratekVRT Sign in

CVE-2012-5076 Oracle JRE

Affected softwareOracle JRE
Affected versions7 Update 7 and before
Severity9.8 Critical CVSS 3.1 2 scores
Fixed inJava SE CPU Oct 2012
WeaknessImproper access control (CWE-284)
Published16 Oct 2012
Updated29 Sep 2026

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2022-03-28 · remediation due 2022-04-18 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 4 citations · earliest 2012-11-12.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
  • Indexed PoC 4 indexed Published artifacts you can open, in Exploit-DB, Metasploit; first seen 2012-11-13.
  • EPSS 91% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2012-5076 in VulnCheck (free account).

EvidenceSourceDetailDate
Reported exploitation threatpost.com /new-java-attack-introduced-cool-exploit-kit-111212/77205 2012-11-12
Reported exploitation archive.f-secure.com /weblog/archives/00002458 2012-11-16
Reported exploitation cybersecurityworks.com /pdf/ransomware/Spotlight_Ransomware2021.pdf 2021-02-11
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2022-03-28
IndexArtifactStarsFirst seen
Exploit-DB Java Applet - AverageRangeStatisticImpl Remote Code Execution (Metasploit) 2013-01-24
Exploit-DB Java Applet - JAX-WS Remote Code Execution (Metasploit) 2012-11-13
Metasploit Java Applet AverageRangeStatisticImpl Remote Code Execution (excellent rank)
Metasploit Java Applet JAX-WS Remote Code Execution (excellent rank)

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Outside Waratek scope.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Java applet / Web Start sandbox escape: needs untrusted code running under the Java sandbox, which a server running trusted code never does.

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary published
CVSS 2.0 10.0 none AV:N/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Java SE CPU Oct 2012 ↗ CPU 2012-Q4 Oracle Java SE / Java Runtime Environment (7 Update 7 and before)
Oracle's note: Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Java SE Java Runtime Environment 7 Update 7 and before

Products and versions

2 products, 9 version entries
SourceVendorProductSchemeAffected versions
nvd oracle jre javase 1.7.0 · 1.7.0:update1 · 1.7.0:update2 · 1.7.0:update3 · 1.7.0:update4 · 1.7.0:update5 · 1.7.0:update6 · 1.7.0:update7
nvd suse linux enterprise desktop generic 11:sp2

References

URLTags
https://access.redhat.com/errata/RHSA-2012:1386 ADVISORY, RHSA-2012:1386
https://access.redhat.com/security/cve/CVE-2012-5076 REPORT, RHSA-2012:1386
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1386.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1391.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-1467.html Third Party Advisory
http://secunia.com/advisories/51029 Not Applicable
http://secunia.com/advisories/51326 Not Applicable
http://secunia.com/advisories/51390 Not Applicable
http://security.gentoo.org/glsa/glsa-201406-32.xml Third Party Advisory

Timeline
Published2012-10-16By the CVE Program.
VulnCheck KEV: earliest evidence2012-11-12Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2022-03-28Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: latest evidence2022-03-28Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
NVD record modified2026-06-16NVD's own last-modified date for this record.
Last VRT activity2026-09-29Most recent commit touching this CVE's classification, patch or rule file.
Classification created2026-11-13First commit adding this CVE's research note.