---
id: "CVE-2015-2590"
kind: "vulnerability"
aliases: ["CVE-2015-2590"]
title: "Oracle Java SE: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.25469
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Oracle Java SE", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["desktop", "exploited", "java", "oracle-jre", "runtime", "self-hosted"]
not_affected_if: ["no-java-installed", "openjdk-only"]
published_at: "2015-07-16T10:59:17+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2590", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-2590", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2590", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Oracle Java SE: Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability

An unspecified flaw in the Oracle Java Runtime Environment lets a remote attacker run code on the affected machine. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Java SE affected ? fixed ?

## How to check

Run 'java -version' on each host and compare the build against Oracle's Java SE update list for the CVE-2015-2590 fix; the sources do not give a specific version.

## Fix

Update Java SE and Java SE Embedded to a release Oracle lists as fixing CVE-2015-2590, per CISA's required action; the sources do not name the version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2015-2590
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2015-2590
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2015-2590

## From the sources

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_