ZeroDay Findings
Sign inSign up

Findings

CVE-2012-4681

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Published Aug 27, 2012 · updated Aug 5, 2026 · oracle jdk

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 27, 2012 · Catalog

    Detected

    Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.

  2. Mar 3, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Mar 24, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Aug 5, 2026 · Catalog

    Updated

    Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.

Required action

Apply updates per vendor instructions.

CISA due date Mar 24, 2022

Affected

  • cpe oracle/jdk1.6.0
  • cpe redhat/enterprise linux desktop6.0
  • vendor Oracle Java SEversion unspecified

Sources

  • CISA KEVCVE-2012-4681

    The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.

    cisa.gov
  • CVE.orgCVE-2012-4681

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2012-4681

    30-day exploitation probability 98.5%

    first.org
  • Exploit Database20865

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesexploit_multi/browser/java_jre17_exec

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2012-4681

    Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findCla

    nvd.nist.gov

References