Actively exploited in the wild

Oracle JRE Sandbox Bypass Vulnerability

Oracle - Java Runtime Environment (JRE) · Listed in the CISA KEV since 2022-05-25. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2013-0431

MediumCVSS 5.3KEV

Published: 31/01/2013(UTC)Updated: 14/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

89.99%

100th percentile - higher than 100% of all known CVEs

Summary

An unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and OpenJDK 7 allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX.

Risk Assessment

Bypassing the Java sandbox could allow unauthorized code execution in the user's environment, posing a serious security threat.

Recommendation

Update Java SE to the latest available version with security fixes. Limit the use of Java applets and JMX-based applications.

Original NVD description (English source)

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.