Oracle Java SE
CVE-2011-3544
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconUser browses to malicious website
-
DeliveryMalicious Java applet auto-loads in browser
-
ExploitExploit triggers Scripting component flaw
-
InstallSandbox escape achieved
-
C2Arbitrary code executes with user privileges
-
ExecuteMalware payload deployed
-
ImpactSystem compromised
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2021 - Broken Access Control
ASVS 5.0
V4 - Access Control Authorization enforcement, RBAC validation
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to have Java browser plugin enabled and to visit a malicious website hosting a weaponized Java applet, or to launch a malicious Java Web Start application. The Java plugin must be configured to run applets (not disabled entirely), though default Java installations from this era allowed applet execution. No authentication is required from the attacker's perspective once the victim browses to the malicious content. Exploitation succeeds against default Java security settings and does not require non-standard Java configurations. The vulnerability affects all platforms where Oracle Java SE 6 Update 27 or earlier, or Java 7 initial release, is installed (Windows, Linux, macOS, Solaris). |
| Impact | This represents critical real-world risk across multiple authoritative signals. CISA KEV status confirms active exploitation campaigns, not theoretical risk. EPSS score of 92.59% at the 100th percentile indicates this vulnerability has been observed in widespread exploitation attempts, consistent with historical mass-exploitation of Java sandbox escapes. The CVSS 9.8 score accurately reflects impact (complete CIA compromise) and exploitability (network-accessible, no authentication, no user interaction required per the vector). However, there is a discrepancy between the CVSS UI:N (no user interaction) and the description stating 'untrusted Java Web Start applications and untrusted Java applets' which typically require user action to visit a malicious site or open a malicious file. This suggests the CVSS vector may overstate ease of exploitation slightly, but given confirmed active exploitation, defenders should treat this as automatable for risk prioritization. Any internet-facing system with vulnerable Java installations running browser plugins or Web Start is at immediate risk. The vulnerability's 2011 vintage means exploitation techniques are mature and well-documented. |
| Exploit ScenarioDerived | An attacker hosts a malicious Java applet on a compromised or attacker-controlled website. When a victim with vulnerable Java visits the site, the applet automatically loads and exploits the Scripting component access control flaw to escape the Java sandbox. The attacker achieves arbitrary code execution with the victim's user privileges, enabling malware installation, credential theft, or lateral movement within the network. Public exploit code existence means even low-skilled attackers can weaponize this vulnerability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 22, 2026
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
Earlier versions of this analysis (1)
A vulnerability in the Java Runtime Environment's Scripting component allows untrusted Java Web Start applications and unsigned Java applets to completely bypass the Java security sandbox, enabling arbitrary code execution with the user's privileges.
RemediationAI
Upgrade to Oracle Java SE 6 Update 29 or Java SE 7 Update 1 or later as specified in Oracle's October 2011 Critical Patch Update (http://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html). For Red Hat Enterprise Linux, apply RHSA-2011-1384 or later Java packages. Ubuntu users should apply USN-1263-1. If immediate patching is not feasible, disable Java browser plugins in all web browsers and uninstall Java Web Start to prevent exploitation via malicious applets-this completely blocks the attack vector but breaks legitimate Java web applications. Alternatively, configure Java security settings to 'Very High' and maintain strict whitelisting of trusted applet sources, though this provides only partial protection against sophisticated exploits. Network-level blocking of Java applet MIME types (application/x-java-applet) at web proxies adds defense-in-depth but may cause operational disruption. Given active exploitation, compensating controls should be considered temporary only until patching is complete.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Scripting component within Oracle Java Runtime Environment, specifically in Java SE 6 (all updates through Update 27) and Java 7 initial release. The Scripting component enables integration between Java and scripting languages like JavaScript through the javax.script API and Rhino engine. CWE-284 (Improper Access Control) indicates the root cause involves insufficient restrictions on what untrusted code can access or execute. The CVSS vector AV:N/AC:L indicates network-based exploitation with low complexity, meaning attackers can trigger the flaw simply by convincing users to visit malicious websites hosting weaponized Java applets or Web Start applications. The vulnerability allows escaping the Java security sandbox, which is designed to restrict untrusted code from accessing system resources.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
Executive ViewAI
CVE-2011-3544 is a critical remote code execution vulnerability in Oracle Java SE (JDK/JRE 6 Update 27 and earlier, Java 7) that allows unauthenticated attackers to achieve complete system compromise through malicious Java Web Start applications and untrusted applets. With confirmation of active exploitation by CISA, an EPSS score in the 100th percentile, and publicly available exploit code, any organization still running affected Java versions faces immediate risk of total system takeover.
Apply vendor patch. If immediate patching is infeasible: disable Java in all web browsers; block Java Web Start (javaws.exe) and unsigned applet execution via Group Policy or endpoint controls; restrict network access to systems running unpatched Java; implement application whitelisting to prevent malicious code execution.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property
GitHub PoC