CVE-2012-1723

CriticalPublished

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Published: Jun 16, 2012
Updated: Aug 6, 2026
Assigning CNA: oracle
Evidence observed: Jul 11, 2012

Primary CVSS

9.8/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

93.7%

High · next 30 days

Percentile: 99.8%
Model date: Oct 13, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

Java Applet Field Bytecode Verifier Cache Remote Code ExecutionModule
modules/exploits/multi/browser/java_verifier_field_access.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: c3e1fbccdfb4Related tool
Declared conditions
- platform: Java,Linux,OSX,Windows($.exploit_multi/browser/java_verifier_field_access.platform)
- verification: check_not_declared($.exploit_multi/browser/java_verifier_field_access.check)

CVE-2012-1723Exploit
Proof of concept exploit for CVE-2012-1723
Java Applet - Field Bytecode Verifier Cache Remote Code Execution (Metasploit)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.