{"id":"CVE-2012-5076","kind":"vulnerability","aliases":["CVE-2012-5076"],"related":[],"title":"Oracle Java SE: Oracle Java SE Sandbox Bypass Vulnerability","description":"The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Oracle Java SE shipped with default security settings that did not block access to two internal packages, com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal. An untrusted Java applet or application could use this to escape the Java sandbox.","severity":"critical","cvss":10.0,"epss":0.9125,"exploited":true,"exploited_at":"2022-03-28T00:00:00+00:00","products":[{"name":"Oracle Java SE","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["applets","exploited","java","oracle-jdk","runtime"],"not_affected_if":["applets-disabled","no-untrusted-java-code"],"how_to_check":null,"fix":"Update Java SE to a release that includes Oracle's fix for this issue (per vendor instructions, as CISA requires). Exact fixed versions: unknown from the sources.","status":"open","published_at":"2012-10-16T21:55:02+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:01+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:20:01Z","model":"claude-haiku-5-5","output":{"fix":"Update Java SE to a release that includes Oracle's fix for this issue (per vendor instructions, as CISA requires). Exact fixed versions: unknown from the sources.","reach":"internet","impact":"high","summary":"Oracle Java SE shipped with default security settings that did not block access to two internal packages, com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal. An untrusted Java applet or application could use this to escape the Java sandbox.","category":"runtime","who_cares":["java","oracle-jdk","applets"],"confidence":0.6,"needs_auth":"no","worst_case":"Untrusted code escapes the sandbox and runs with full local user rights.","analyst_note":"Confirm fixed Java SE versions and the detection method from Oracle's CVE-2012-5076 advisory; the sources list no versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-untrusted-java-code","applets-disabled"],"user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000477,"input_tokens":2862,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2012':11A,14A '-5076':12A,15A 'access':38B,69C 'action':93C 'applet':19B,49B,81C 'appli':94C 'applic':51B,79C 'block':37B 'bypass':8A,87C 'cisa':91C 'com.sun.org.glassfish.external':43B,72C 'com.sun.org.glassfish.gmbal':45B,74C 'configur':65C 'could':52B,82C 'cve':10A,13A 'default':31B,61C 'escap':56B 'exploit':20B 'flaw':85C 'instruct':98C 'intern':41B 'java':2A,5A,17A,21B,27B,48B,58B,62C,78C,88C 'jdk':24B 'oracl':1A,4A,23B,26B 'oracle':16A 'oracle-jdk':22B 'packag':42B,75C 'per':96C 'properti':64C 'requir':92C 'restrict':68C,90C 'runtim':25B 'sandbox':7A,59B,89C 'se':3A,6A,18A,28B 'secur':32B,63C 'set':33B 'ship':29B 'two':40B 'untrust':47B,77C 'updat':95C 'use':53B,83C 'vendor':97C 'vulner':9A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2012-10-16T21:55:02+00:00","kev":{"dateAdded":"2022-03-28","dueDate":"2022-04-18","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2012-5076","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-5076","severity":null,"published_at":"2022-03-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T13:39:31+00:00","note":null},{"source":"epss","external_id":"CVE-2012-5076","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-5076","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2012-5076","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-5076","severity":null,"published_at":"2012-10-16T21:55:02+00:00","modified_at":"2026-06-16T23:46:10+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}