---
id: "CVE-2010-0840"
kind: "vulnerability"
aliases: ["CVE-2010-0840"]
title: "Oracle Java Runtime Environment (JRE): Oracle JRE Unspecified Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.96319
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Oracle Java Runtime Environment (JRE)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["desktop", "exploited", "java", "runtime", "self-hosted"]
not_affected_if: ["no-jre-installed"]
published_at: "2010-04-01T16:30:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0840", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-0840", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0840", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Oracle Java Runtime Environment (JRE): Oracle JRE Unspecified Vulnerability

An unspecified flaw in the Java Runtime Environment (Java SE) lets remote attackers affect confidentiality, integrity and availability through unknown vectors. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Java Runtime Environment (JRE) affected ? fixed ?

## How to check

Run java -version on each host and compare the build to the vendor's patched release; the sources do not give a fixed version.

## Fix

Update the Java Runtime Environment to a current supported Oracle Java SE release per vendor instructions.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-0840
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-0840
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-0840

## From the sources

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_