---
id: "CVE-2012-4681"
kind: "vulnerability"
aliases: ["CVE-2012-4681"]
title: "Oracle Java SE: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.98536
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Oracle Java SE", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Oracle Java SE (JDK/JRE)", "fixed": [], "affected": "7 Update 6 and before", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["applet", "browser", "desktop", "exploited", "java", "jre", "oracle-java-se", "ransomware", "runtime", "windows"]
not_affected_if: ["java-6", "java-se-embedded", "no-browser-plugin", "no-java-installed", "server-only", "standalone-app"]
published_at: "2012-08-28T00:55:01+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-4681", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-4681", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:26:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4681", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Oracle Java SE: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Beans-component flaw in the Java 7 browser plug-in (JDK/JRE 7 Update 6 and before). A malicious web page running an untrusted applet or Web Start app escapes the sandbox and runs code (CVSS 2.0 10.0). Exploited in the wild since Aug 2012, Metasploit module public, in CISA KEV since 2022-03-03. Oracle says it does not apply to servers, standalone desktop apps or Java SE Embedded. The same alert also fixes CVE-2012-1682 and CVE-2012-3136.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Java SE affected ? fixed ?
- vendor:Oracle Java SE (JDK/JRE) affected 7 Update 6 and before fixed ?

## How to check

Run 'java -version' on desktops. Java 7 at 1.7.0_06 or earlier is affected. Check whether the Java browser plug-in or applets / Web Start are enabled (Java Control Panel > Security). Java 6 is not listed as affected for this CVE; Oracle's risk matrix lists only Java 7.

## Fix

Move Java 7 to a current supported release (Oracle's alert fix is cumulative; the exact Update number is not stated on the page, so unknown from sources). Disable the Java browser plug-in and remove old JREs that are not needed.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-4681
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2012-4681
- 2026-10-23T21:26:51+00:00 analyst — Read Oracle's Security Alert (30 Aug 2012) and NVD/KEV entry. Browser/applet only; exact fixed Update number is not on the Oracle page (says apply latest, cumulative), so left unknown.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2012-4681

## Documents

- [advisory] Oracle Security Alert for CVE-2012-4681 https://www.oracle.com/security-alerts/alert-cve-2012-4681.html
- [describes] NVD CVE-2012-4681 (KEV entry, references) https://nvd.nist.gov/vuln/detail/CVE-2012-4681

## From the sources

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_