ZeroDay Findings
Sign inSign up

Findings

CVE-2011-3544

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Published Oct 19, 2011 · updated Jun 16, 2026 · oracle jdk

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 19, 2011 · Catalog

    Detected

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 24, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

Required action

Apply updates per vendor instructions.

CISA due date Mar 24, 2022

Affected

  • cpe canonical/ubuntu linux10.04
  • cpe oracle/jdkversion unspecified
  • cpe oracle/jdk1.6.0
  • cpe redhat/satellite with embedded oracle5.4
  • cpe suse/linux enterprise java10
  • vendor Oracle Java SE JDK and JREversion unspecified

Sources

  • CISA KEVCVE-2011-3544

    An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.

    cisa.gov
  • CVE.orgCVE-2011-3544

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2011-3544

    30-day exploitation probability 96.7%

    first.org
  • Exploit Database18171

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/browser/java_rhino

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2011-3544

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vector

    nvd.nist.gov

References