CVE-2012-4681VulnerabilityPublished 03/03/2022Updated 10/24/2026

CVE-2012-4681: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Affects Oracle Java SESource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/03/2022
KEV deadline: 03/24/2022
Ransomware: Used in ransomware campaigns
EPSS: 98.5% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2012-4681 (opens in a new tab)

Description

CVE-2012-4681 is a high-severity vulnerability in the Oracle Java SE Runtime Environment (JRE) that allows remote attackers to execute arbitrary code. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. No specific affected versions or patch information is provided in the available data.

Summary

The Java Runtime Environment (JRE) component in Oracle Java SE contains a vulnerability identified as CVE-2012-4681 that permits remote code execution. This flaw has been actively exploited in the wild, including usage in ransomware attacks. The input data does not specify which versions are affected or whether a patch is available.

Impact

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. The vulnerability has been observed in active exploitation scenarios, including ransomware campaigns, indicating a significant real-world threat.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or mitigations are confirmed, organizations should monitor vendor communications for updates and apply patches promptly once available.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 10:25:39 UTC

References

Related threats