Oracle Java SE known exploited vulnerabilities, ranked
CISA lists 7 Oracle Java SE CVEs as exploited in the wild. 0 were added in the last 12 months and 4 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2013-2465: EPSS 98.8%, used in ransomware, added 2022-03-28
- CVE-2012-4681: EPSS 98.5%, used in ransomware, added 2022-03-03
- CVE-2012-0507: EPSS 98.1%, used in ransomware, added 2022-03-03
- CVE-2012-1723: EPSS 93.7%, used in ransomware, added 2022-03-03
- CVE-2012-5076: EPSS 91.2%, added 2022-03-28
All 7 Oracle Java SE CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2013-2465 | Java SE Unspecified | 98.8% | Yes | 2022-03-28 | 2022-04-18 |
| 2 | CVE-2012-4681 | Java SE Runtime Environment (JRE) Arbitrary Code Execution | 98.5% | Yes | 2022-03-03 | 2022-03-24 |
| 3 | CVE-2012-0507 | Java SE Runtime Environment (JRE) Arbitrary Code Execution | 98.1% | Yes | 2022-03-03 | 2022-03-24 |
| 4 | CVE-2012-1723 | Java SE Runtime Environment (JRE) Arbitrary Code Execution | 93.7% | Yes | 2022-03-03 | 2022-03-24 |
| 5 | CVE-2012-5076 | Java SE Sandbox Bypass | 91.2% | – | 2022-03-28 | 2022-04-18 |
| 6 | CVE-2015-2590 | Java SE and Java SE Embedded Remote Code Execution | 25.5% | – | 2022-03-03 | 2022-03-24 |
| 7 | CVE-2015-4902 | Java SE Integrity Check | 13.6% | – | 2022-03-03 | 2022-03-24 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Oracle KEV CVEs · other Oracle products: WebLogic Server · Fusion Middleware · free KEV badge for Oracle · all vendors