---
id: "CVE-2012-5076"
kind: "vulnerability"
aliases: ["CVE-2012-5076"]
title: "Oracle Java SE: Oracle Java SE Sandbox Bypass Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.9125
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Oracle Java SE", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["applets", "exploited", "java", "oracle-jdk", "runtime"]
not_affected_if: ["applets-disabled", "no-untrusted-java-code"]
published_at: "2012-10-16T21:55:02+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-5076", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-5076", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5076", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Oracle Java SE: Oracle Java SE Sandbox Bypass Vulnerability

Oracle Java SE shipped with default security settings that did not block access to two internal packages, com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal. An untrusted Java applet or application could use this to escape the Java sandbox.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Java SE affected ? fixed ?

## Fix

Update Java SE to a release that includes Oracle's fix for this issue (per vendor instructions, as CISA requires). Exact fixed versions: unknown from the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-5076
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2012-5076
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2012-5076

## From the sources

The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_