Oracle JRE
CVE-2013-2460
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser visits malicious site
-
DeliveryBrowser loads weaponized Java applet
-
ExploitExploit triggers tracing component flaw
-
ExecutionBypass sandbox access checks
-
PersistExecute arbitrary code with user privileges
-
ImpactInstall persistence or exfiltrate data
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires users to execute untrusted Java code, typically through visiting a malicious or compromised website hosting a malicious Java applet when the Java browser plugin is enabled, or by opening a crafted Java application file (JAR). The CVSS AC:M (medium complexity) indicates that exploitation depends on user interaction-specifically navigating to attacker-controlled content and allowing Java execution. Java's default security prompts may be bypassed through social engineering or code signing with stolen certificates. The vulnerability affects only Java 7 installations up to Update 21; Java 6, Java 8, and patched Java 7 Update 25+ are not vulnerable. Both Oracle JRE and OpenJDK 7 implementations are susceptible. Exploitation is limited to systems where Java is installed and enabled-environments that have removed Java entirely or disabled browser plugin support are not at risk from the primary remote attack vector, though standalone Java applications could still be exploited via malicious JAR delivery. |
| Impact | This represents a critical real-world risk despite being a 2013 vulnerability. The CVSS vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) indicates network-based exploitation with medium complexity, requiring no authentication for complete system compromise. The EPSS score of 92.14% in the 100th percentile is exceptionally high, reflecting that this vulnerability was widely integrated into exploit kits and automated attack tools. Public exploit code availability combined with the 92% exploitation probability indicates this was actively weaponized post-disclosure. The AC:M (medium complexity) likely stems from requiring users to visit a malicious website or open a crafted Java application, but given Java's former ubiquity in browsers, this was a low barrier. The sandbox escape capability made this particularly valuable to attackers, as it transformed browser-based Java from a restricted environment to full system access. While no CISA KEV data is provided for this 2013 CVE (predating the KEV catalog's creation in 2021), the combination of public exploits, extreme EPSS score, and complete impact ratings (C:C/I:C/A:C) confirms this was a priority threat during its active period. Organizations still running legacy Java 7 environments face continued critical risk. |
| Exploit ScenarioDerived | An attacker hosts a malicious website containing a specially crafted Java applet that exploits insufficient access checks in the JRE tracing component. When a user with vulnerable Java 7 Update 21 or earlier visits the site, the applet loads in their browser's Java plugin and leverages the serviceability flaw to bypass sandbox restrictions. The attacker's code then escapes the JVM security perimeter and executes arbitrary commands with the privileges of the user's browser process, enabling malware installation, data exfiltration, or lateral network movement. Publicly available exploit code significantly lowers the technical skill required for this attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Apr 29, 2026
Java Runtime Environment 7 Update 21 and earlier allows remote attackers to escape the Java sandbox and execute arbitrary code via insufficient access checks in the tracing/serviceability component. Publicly available exploit code exists for this medium-complexity network attack, which achieved a 92.14% EPSS score (100th percentile), indicating extremely high likelihood of exploitation. Oracle addressed this vulnerability in their June 2013 Critical Patch Update, though the exact nature of the serviceability component flaw was not fully disclosed by the vendor.
Earlier versions of this analysis (1)
Java Runtime Environment vulnerability in the Serviceability component allows remote code execution through crafted Java content in browser contexts.
RemediationAI
Upgrade Oracle JRE to version 7 Update 25 or later, released in Oracle's June 2013 Critical Patch Update (CPU) available at http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html. For OpenJDK 7 users, apply the upstream fix from commit 160cde99bb1a available at http://hg.openjdk.java.net/jdk7u/jdk7u/jdk/rev/160cde99bb1a or update to distribution-provided patched packages per vendor advisories (Red Hat RHSA-2013-0963 for immediate remediation). As compensating controls if immediate patching is not feasible: disable Java browser plugins entirely via browser settings or the Java Control Panel's 'Enable Java content in the browser' option, which eliminates the remote attack vector but prevents all browser-based Java applets from running; implement application whitelisting to restrict Java execution to only trusted, business-essential applications; or deploy Java with the 'deployment.security.level' set to 'VERY_HIGH' and maintain a strict whitelist of approved application URLs in the exception site list, though this provides limited protection against sophisticated exploits. Note that disabling browser plugins does not protect standalone Java applications from exploitation via malicious JAR files. Organizations should prioritize complete upgrade to supported Java versions (Java 8 or later as of 2024) rather than prolonged reliance on mitigations for this end-of-life Java 7 branch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability affects the Serviceability component within the Java Runtime Environment (JRE), specifically Oracle Java SE 7 Update 21 and earlier, as well as OpenJDK 7 implementations. The Serviceability component provides diagnostic and monitoring capabilities for Java applications, including tracing, profiling, and management interfaces. Third-party analysis suggests the root cause involves insufficient access checks in the tracing subsystem, allowing malicious code to bypass the Java Security Manager sandbox restrictions. The Java sandbox is designed to restrict untrusted code (such as applets or web-delivered Java applications) from accessing system resources, but this flaw permitted escape from those restrictions. The OpenJDK commit (160cde99bb1a) in the references provides the upstream fix implementation details. Without a specific CWE classification, the vulnerability class appears related to improper access control or privilege management within the JVM's internal diagnostic facilities.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:M/Au:N/C:C/I:C/A:C
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "insufficient access checks" in the tracing component.
Executive ViewAI
CVE-2013-2460 is a critical Java sandbox escape vulnerability affecting Java Runtime Environment 7 Update 21 and earlier that enables unauthenticated remote code execution with a 92.1% exploitation probability. Organizations running affected Java versions face immediate risk of complete system compromise, as public exploit code is available and attackers can bypass all Java security controls without authentication.
If immediate patching is impossible: disable Java applet execution in browsers, restrict network access to Java-based services to trusted networks only, and disable the Java plugin in all browsers. Apply vendor patch (Java 7 Update 25 or later from June 2013 Critical Patch Update) as primary remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
GitHub PoC