{"id":"CVE-2010-0840","kind":"vulnerability","aliases":["CVE-2010-0840"],"related":[],"title":"Oracle Java Runtime Environment (JRE): Oracle JRE Unspecified Vulnerability","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) \"a similar trust issue with interfaces,\" aka \"Trusted Methods Chaining Remote Code Execution Vulnerability.\"","summary":"An unspecified flaw in the Java Runtime Environment (Java SE) lets remote attackers affect confidentiality, integrity and availability through unknown vectors. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":9.8,"epss":0.96319,"exploited":true,"exploited_at":"2022-05-25T00:00:00+00:00","products":[{"name":"Oracle Java Runtime Environment (JRE)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop","exploited","java","runtime","self-hosted"],"not_affected_if":["no-jre-installed"],"how_to_check":"Run java -version on each host and compare the build to the vendor's patched release; the sources do not give a fixed version.","fix":"Update the Java Runtime Environment to a current supported Oracle Java SE release per vendor instructions.","status":"open","published_at":"2010-04-01T16:30:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:31+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-23T21:15:31Z","model":"claude-haiku-5-5","output":{"fix":"Update the Java Runtime Environment to a current supported Oracle Java SE release per vendor instructions.","reach":"unknown","impact":"high","summary":"An unspecified flaw in the Java Runtime Environment (Java SE) lets remote attackers affect confidentiality, integrity and availability through unknown vectors. CISA lists it as actively exploited in the wild.","category":"runtime","who_cares":["java","self-hosted","desktop"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may gain control of affected Java runtime and its host","analyst_note":"Sources do not name affected or fixed versions or attack vector; check Oracle's 2010 Java SE security advisory and the CISA KEV entry for specifics.","how_to_check":"Run java -version on each host and compare the build to the vendor's patched release; the sources do not give a fixed version.","needs_analyst":true,"not_affected_if":["no-jre-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000474,"input_tokens":2857,"output_tokens":376,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0840':12A,15A '-2010':11A,14A '1':141C '1.4.2':81C '18':76C '2':158C '2010':104C '23':79C '25':82C '5.0':77C '6':74C 'activ':53B 'affect':41B,87C 'aka':165C 'allow':83C,134C 'arbitrari':138C 'attack':40B,85C,135C 'avail':45B,91C 'busi':73C 'certain':155C 'chain':168C 'check':122C 'cisa':49B 'claim':111C 'class':149C 'code':139C,170C 'comment':109C 'compon':65C 'confidenti':42B,88C 'cpu':105C 'cve':10A,13A 'desktop':21B 'environ':4A,35B,64C,131C 'environment':19A 'execut':124C,137C,171C 'exploit':22B,54B 'extend':146C 'flaw':30B 'host':27B 'improp':121C 'inform':98C 'integr':43B,89C 'interfac':164C 'issu':162C 'java':2A,17A,23B,33B,36B,62C,68C,71C,129C 'jre':5A,7A,20A,132C 'let':38B 'list':50B 'march':103C 'method':126C,156C,167C 'modifi':153C 'note':95C 'object':144C 'obtain':100C 'oracl':1A,6A,67C,106C 'oracle':16A 'previous':97C 'privileg':125C 'relat':119C 'reliabl':114C 'remot':39B,84C,169C 'research':115C 'runtim':3A,24B,34B,63C,130C 'runtime':18A 'se':37B,69C 'self':26B 'self-host':25B 'similar':160C 'trust':148C,161C,166C 'unknown':47B,93C 'unspecifi':8A,29B,58C 'untrust':143C 'updat':75C,78C 'vector':48B,94C 'via':92C,140C 'vulner':9A,59C,172C 'wild':57B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-04-01T16:30:00+00:00","kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-0840","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0840","severity":null,"published_at":"2022-05-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T14:39:40+00:00","note":null},{"source":"epss","external_id":"CVE-2010-0840","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-0840","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2010-0840","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-0840","severity":null,"published_at":"2010-04-01T16:30:00+00:00","modified_at":"2026-06-16T23:16:57+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}