Is CVE-2012-4681 being actively exploited?

Yes. CVE-2012-4681 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on March 3, 2022.

What is the CVSS score for CVE-2012-4681?

CVE-2012-4681 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2012-4681

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 98.5%EU EUVD: exploited

Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using "reflection with a trusted immediate caller" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-284
EPSS score: 98.5% (100th percentile)
In CISA KEV: Yes, added March 3, 2022
In EU EUVD: Yes (EUVD-2012-4606)
Published: August 28, 2012
NVD last modified: August 6, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability

Added to the KEV catalog on March 3, 2022; federal remediation due March 24, 2022. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2012-4606 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on August 6, 2026.

View on the EU Vulnerability Database

Affected products

oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jre
oracle / jre
oracle / jre
oracle / jre
oracle / jre
oracle / jre
oracle / jre
oracle / jre
oracle / jre

and 35 more…

References

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html(Third Party Advisory)
http://immunityproducts.blogspot.com/2012/08/java-0day-analysis-cve-2012-4681.html(Exploit, Third Party Advisory)
http://labs.alienvault.com/labs/index.php/2012/new-java-0day-exploited-in-the-wild/(Broken Link, Exploit)
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00032.html(Mailing List)
http://lists.opensuse.org/opensuse-security-announce/2012-10/msg00016.html(Mailing List)
http://marc.info/?l=bugtraq&m=135109152819176&w=2(Issue Tracking, Mailing List, Third Party Advisory)
http://rhn.redhat.com/errata/RHSA-2012-1225.html(Third Party Advisory)
http://secunia.com/advisories/51044(Not Applicable)
http://www.deependresearch.org/2012/08/java-7-vulnerability-analysis.html(Broken Link, Third Party Advisory)
http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html(Vendor Advisory)
http://www.securityfocus.com/bid/55213(Broken Link, Third Party Advisory, VDB Entry)
http://www.us-cert.gov/cas/techalerts/TA12-240A.html(Third Party Advisory, US Government Resource)
https://community.rapid7.com/community/metasploit/blog/2012/08/27/lets-start-the-week-with-a-new-java-0day(Broken Link, Third Party Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-4681(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain