CVE-2012-5076

KEVOracle Java SE Sandbox Bypass Vulnerability

Description

The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to JAX-WS.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedOct 16, 2012

Last modifiedJun 16, 2026

Added to KEVMar 28, 2022

Remediation dueApr 18, 2022

References

lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.htmlMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2012-1386.htmlThird Party Advisory
rhn.redhat.com/errata/RHSA-2012-1391.htmlThird Party Advisory
rhn.redhat.com/errata/RHSA-2012-1467.htmlThird Party Advisory
secunia.com/advisories/51029Not Applicable
secunia.com/advisories/51326Not Applicable
secunia.com/advisories/51390Not Applicable
security.gentoo.org/glsa/glsa-201406-32.xmlThird Party Advisory
oracle.com/technetwork/topics/security/javacpuoct2012-1515924.htmlPatchVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16641Broken Link
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-5076US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1653 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 91.3% · top 1% of all CVEs
Weakness: NVD-CWE-Other
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.