$ cve CVE-2012-5076 JSON

CVE-2012-5076 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 91.3% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-04-18.

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	91.25% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-284
On CISA KEV	yes — remediate by 2022-04-18
Public exploit	yes
Published	2012-10-16
Last modified	2026-06-16

CISA KEV

Name	Oracle Java SE Sandbox Bypass Vulnerability
Added	2022-03-28
Due	2022-04-18
Vendor / product	Oracle / Java SE
Ransomware use	none reported

Affected (2)

Vendor	Product
oracle	jre
suse	linux enterprise desktop

Public exploits

Source	Title	Date
exploit-db	Java Applet - AverageRangeStatisticImpl Remote Code Execution (Metasploit)	2013-01-24
exploit-db	Java Applet - JAX-WS Remote Code Execution (Metasploit)	2012-11-13

References

→ the Explorer · watch your stack · NVD