Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2012-06-16

CVE-2012-1723

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

  1. First PoC
  2. 4908 days →Metasploit
  3. 304 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2022-03-03 · due 2022-03-24 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
94%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

2 known · links only

Metasploit1

  1. Java Applet Field Bytecode Verifier Cache Remote Code Execution ↗

    This module exploits a vulnerability in HotSpot bytecode verifier where an invalid optimization of GETFIELD/PUTFIELD/GETSTATIC/PUTSTATIC instructions leads to insufficient type checks. This allows a way to escape the JRE sandbox, and load additional classes in order to perform malicious operations.

    ruby · seen 2026-10-18

Exploit-DB1

  1. Java Applet - Field Bytecode Verifier Cache Remote Code Execution (Metasploit) ↗

    created 2012-07-11

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.