{"id":"CVE-2015-2590","kind":"vulnerability","aliases":["CVE-2015-2590"],"related":[],"title":"Oracle Java SE: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability","description":"Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.","summary":"An unspecified flaw in the Oracle Java Runtime Environment lets a remote attacker run code on the affected machine. CISA lists it as actively exploited in the wild.","severity":"critical","cvss":10.0,"epss":0.25469,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Oracle Java SE","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop","exploited","java","oracle-jre","runtime","self-hosted"],"not_affected_if":["no-java-installed","openjdk-only"],"how_to_check":"Run 'java -version' on each host and compare the build against Oracle's Java SE update list for the CVE-2015-2590 fix; the sources do not give a specific version.","fix":"Update Java SE and Java SE Embedded to a release Oracle lists as fixing CVE-2015-2590, per CISA's required action; the sources do not name the version.","status":"open","published_at":"2015-07-16T10:59:17+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:14+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:26:14Z","model":"claude-haiku-5-5","output":{"fix":"Update Java SE and Java SE Embedded to a release Oracle lists as fixing CVE-2015-2590, per CISA's required action; the sources do not name the version.","reach":"internet","impact":"high","summary":"An unspecified flaw in the Oracle Java Runtime Environment lets a remote attacker run code on the affected machine. CISA lists it as actively exploited in the wild.","category":"runtime","who_cares":["java","oracle-jre","self-hosted","desktop"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the Java host remotely.","analyst_note":"Find the affected and fixed Oracle Java SE versions and the attack trigger (applet, web start or network service) in Oracle's CVE-2015-2590 advisory; the sources give neither.","how_to_check":"Run 'java -version' on each host and compare the build against Oracle's Java SE update list for the CVE-2015-2590 fix; the sources do not give a specific version.\nunknown","needs_analyst":true,"not_affected_if":["no-java-installed","openjdk-only"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000497,"input_tokens":2829,"output_tokens":429,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2015':16A,19A,99C '-2590':17A,20A '-4732':100C '6u95':68C '7u75':76C '7u80':69C '8u33':78C '8u45':71C 'activ':57B 'affect':51B,83C 'allow':79C 'attack':46B,81C 'avail':87C 'cisa':53B 'code':12A,48B 'confidenti':84C 'cve':15A,18A,98C 'desktop':24B 'differ':95C 'embed':10A,75C 'environ':42B 'execut':13A 'exploit':25B,58B 'flaw':36B 'host':33B 'integr':85C 'java':2A,5A,8A,22A,26B,40B,66C,73C 'jre':29B 'let':43B 'librari':93C 'list':54B 'machin':52B 'oracl':1A,4A,28B,39B,65C 'oracle':21A 'oracle-jr':27B 'relat':91C 'remot':11A,45B,80C 'run':47B 'runtim':30B,41B 'se':3A,6A,9A,23A,67C,74C 'self':32B 'self-host':31B 'unknown':89C 'unspecifi':35B,62C 'vector':90C 'via':88C 'vulner':14A,63C,96C 'wild':61B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2015-07-16T10:59:17+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2015-2590","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2590","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:17+00:00","note":null},{"source":"epss","external_id":"CVE-2015-2590","url":"https://api.first.org/data/v1/epss?cve=CVE-2015-2590","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2015-2590","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2590","severity":null,"published_at":"2015-07-16T10:59:17+00:00","modified_at":"2026-06-17T00:24:21+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}