CVE-2013-0431VulnerabilityPublished 05/25/2022Updated 10/24/2026

CVE-2013-0431: Oracle JRE Sandbox Bypass Vulnerability

Affects Oracle Java Runtime Environment (JRE)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 05/25/2022
KEV deadline: 06/15/2022
Ransomware: Used in ransomware campaigns
EPSS: 90.1% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2013-0431 (opens in a new tab)

Description

CVE-2013-0431 is a high-severity vulnerability in Oracle's Java Runtime Environment (JRE) that allows remote attackers to bypass the Java security sandbox. This vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns. The specific technical details of the vulnerability are unspecified in the provided data. No affected versions or patch information are provided in the input.

Summary

CVE-2013-0431 is an unspecified vulnerability in the Java Runtime Environment (JRE) component from Oracle that enables remote attackers to bypass the Java security sandbox. This sandbox bypass allows attackers to execute code with fewer restrictions than intended, potentially leading to unauthorized actions on affected systems. The vulnerability has been confirmed to be exploited in the wild and has been associated with ransomware campaigns. However, no detailed technical information or affected version ranges are provided in the source data.

Impact

The vulnerability allows remote attackers to bypass the Java security sandbox, potentially enabling execution of unauthorized code and compromising system security. Exploitation in the wild and use in ransomware campaigns indicate a significant real-world impact. The lack of detailed version or patch information limits precise impact assessment, but the high severity and known exploitation suggest serious risk to affected systems running vulnerable JRE versions.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or remediation details are provided, users should consult Oracle's official security advisories for updates. Until a fix is confirmed, consider disabling or restricting Java execution in browsers and applications to reduce exposure.

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:49:22 UTC

References

Related threats