Threats / Oracle / CVE-2013-0422
CVE-2013-0422
· EUVD no mirror located
· GCVE no mirror located
Verified 2026-06-22
Oracle Java Runtime Environment (JRE) vulnerability
A permissions restriction bypass in Java applets allows attackers to execute arbitrary commands on vulnerable systems running Oracle JRE.
Verdict
Today item, not a backlog item.
This vulnerability permits remote code execution through malicious Java applets that circumvent sandbox restrictions. Active exploitation and ransomware deployment have been documented, making it a critical threat to systems running unpatched Java Runtime Environments.
01
Is it exploitable?
— the evidence, ranked above the scoreReported exploitation
11 independent public reports of in-the-wild exploitation are cataloged.Distinct reporting sources (vendor, incident response, government); open them for the underlying claims.
Exploited in the wild
Listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-05-25), flagged for known ransomware use.
Probability (EPSS)
EPSS 0.97612 — modeled likelihood of exploitation activity.EPSS is a daily-changing model output — open the source for today's value.
Severity / affected
Affected: Oracle, Java Runtime Environment (JRE). Confirm exact fixed builds in the vendor advisory.
Weakness (CWE)
Mapped to CWE-264 Permissions/Privileges/Access Control — weakness family: Authorization / access control.CWE assignment from the public NVD record; the weakness class drives how the flaw is exploited.
02
Who’s exploiting it?
— attribution turns risk into urgencyAttribution not established
No confirmed (advisory-backed) threat-actor attribution is established for this record. Absence of a named actor is not absence of compromise — see Coverage & confidence.
03
Why it matters
— the attack path, told twice: adversary, then board1
Front door — unauthenticated access narrative 1
Attacker
I craft a malicious Java applet that exploits the permissions restriction bypass to escape the sandbox environment.
Business
An attacker gains the ability to execute arbitrary code with the privileges of the user running the Java application.
2
Keys to the kingdom — privilege/identity takeover narrative 2
Attacker
I distribute the applet through compromised websites or drive-by download attacks targeting users who visit them.
Business
Affected organizations experience widespread system compromise across user endpoints without requiring user interaction beyond visiting a webpage.
3
Lateral reach — past segmentation narrative 3
Attacker
I deploy ransomware or data exfiltration malware on compromised systems to monetize or conduct espionage.
Business
Organizations face operational disruption, data loss, extortion demands, and regulatory penalties from ransomware campaigns exploiting this vulnerability.
04
What to do
— defensible action- Remediate per the vendor advisory — confirm the fixed build for your version and verify exposure.1
Say it to the boardA vulnerability with this evidence profile is a defensible budget line, not a backlog ticket — fund the change against the proof above.
05