$ cve CVE-2011-3544 JSON

CVE-2011-3544 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 96.7% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-03-24.

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	96.71% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-284
On CISA KEV	yes — remediate by 2022-03-24
Public exploit	yes
Published	2011-10-19
Last modified	2026-06-16

CISA KEV

Name	Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Added	2022-03-03
Due	2022-03-24
Vendor / product	Oracle / Java SE JDK and JRE
Ransomware use	none reported

Affected (6)

Vendor	Product
canonical	ubuntu linux
oracle	jdk
oracle	jre
redhat	satellite with embedded oracle
suse	linux enterprise java
suse	linux enterprise server

Public exploits

Source	Title	Date
exploit-db	Java Applet Rhino Script Engine - Remote Code Execution (Metasploit)	2011-11-30

References

→ the Explorer · watch your stack · NVD