CVE-2010-0840

CRITICAL(9.8)KEVLikely Exploited

Oracle JRE Unspecified Vulnerability

Description

CVE-2010-0840 is a critical vulnerability in the Oracle Java Runtime Environment (JRE) Java SE component that allows remote attackers to affect the confidentiality, integrity, and availability of the system. The unspecified vulnerability enables complete compromise of systems running affected JRE versions through crafted Java content delivered via web browsers. CISA has confirmed active exploitation by including CVE-2010-0840 in the Known Exploited Vulnerabilities catalog. With an EPSS percentile of 99.7%, this vulnerability is among the most actively exploited in the entire CVE database, reflecting its central role in exploit kit campaigns of the early 2010s.

KEV Information

Vendor
Oracle
Product
Java Runtime Environment (JRE)
Date Added
May 25, 2022
Due Date
June 15, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

Affected Products

VendorProductVersion
oraclejre1.4.2_25; 1.5.0; 1.6.0
opensuseopensuse11.0; 11.1; 11.2
canonicalubuntu linux8.04; 8.10; 9.04; 9.10

Multiple CVSS Assessments

Source: [email protected](Primary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

Since no specific CWE has been assigned to CVE-2010-0840, the underlying weakness type remains formally unspecified. The vulnerability resides in the Java SE component of the JRE and involves unknown vectors that allow remote attackers to achieve full system compromise. The comprehensive impact across confidentiality, integrity, and availability suggests a sandbox escape or remote code execution flaw in the Java runtime.

Impact Analysis

CVE-2010-0840 enables remote attackers to fully compromise systems running the vulnerable Java Runtime Environment, impacting confidentiality, integrity, and availability simultaneously. The vulnerability is remotely exploitable through the network, typically via malicious Java applets loaded through web browsers. Successful exploitation grants the attacker full access to read sensitive data, modify system files, and disrupt system operations. The comprehensive impact across all three security domains indicates the attacker gains arbitrary code execution capabilities equivalent to the privileges of the user running the browser. The EPSS percentile of 99.7% reflects the extreme exploitation frequency, as this vulnerability was actively incorporated into exploit kits that targeted millions of endpoints during the peak era of Java browser plugin exploitation.

Exploit Maturity

CISA has confirmed active exploitation of CVE-2010-0840 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 15, 2022. The EPSS percentile of 99.7% places this vulnerability in the top 0.3% of all CVEs for exploitation likelihood, confirming sustained and widespread exploitation. Java vulnerabilities from this period were the dominant vector for drive-by download attacks, and CVE-2010-0840 was integrated into multiple major exploit kits. The combination of a ubiquitously deployed browser plugin and a reliable remote code execution vulnerability made this one of the most effective mass exploitation tools available to cybercriminals.

Remediation

  1. Update the Oracle Java Runtime Environment to a version that addresses CVE-2010-0840. CISA's required action is to apply updates per vendor instructions.
  2. Remove the Java browser plugin from all endpoints, as Oracle has deprecated browser plugin support. This eliminates the primary remote attack vector.
  3. If Java is required for specific applications, deploy only the latest supported JRE/JDK and restrict execution to approved applications through deployment rule sets and application whitelisting.
  4. Deploy network-level protections including web content filtering and intrusion prevention systems to block exploit kit landing pages and malicious Java content delivery.
  5. Audit all endpoints for Java installations and remove unnecessary or outdated Java versions that may still be present alongside current installations.

Technical Details

CVE-2010-0840 targets an unspecified vulnerability in the Java SE component of the Oracle Java Runtime Environment. The JRE's security model is designed to execute untrusted code (such as applets loaded from the web) within a restricted sandbox that limits access to local system resources. This vulnerability defeats the sandbox entirely, allowing remote attackers to execute arbitrary code with the full privileges of the Java process. The attack is delivered through crafted Java content, typically applets embedded in web pages, that exploit the flaw when processed by the JVM. The comprehensive impact on confidentiality, integrity, and availability confirms that the attacker achieves unrestricted code execution on the target system. While Oracle did not publicly detail the specific mechanism, the behavior is consistent with a type confusion, deserialization, or reflection-based sandbox escape in the core Java SE libraries.

Frequently Asked Questions

Is CVE-2010-0840 being actively exploited?

Yes, CISA has confirmed active exploitation of CVE-2010-0840 and added it to the Known Exploited Vulnerabilities (KEV) catalog. The EPSS percentile of 99.7% confirms it is among the most exploited CVEs. It was widely integrated into exploit kits for mass exploitation campaigns.

What products are affected by CVE-2010-0840?

CVE-2010-0840 affects the Oracle Java Runtime Environment (JRE), specifically the Java SE component. All JRE versions prior to the security update addressing this vulnerability are affected. Systems with the Java browser plugin enabled were the primary target.

How do I fix CVE-2010-0840?

Update to the latest supported version of the Oracle JRE and remove the Java browser plugin from all systems. If Java is needed for specific applications, restrict its execution to approved applications and keep the runtime fully patched.

How severe is CVE-2010-0840?

CVE-2010-0840 is a critical vulnerability with an EPSS percentile of 99.7%, making it one of the most exploited CVEs in existence. It allows remote attackers to fully compromise systems through the Java Runtime Environment, affecting confidentiality, integrity, and availability.

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score96.32%
EPSS Percentile99.9%

Dates

PublishedApril 1, 2010
Last ModifiedJune 16, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch