Is CVE-2020-2604 being actively exploited?

CVE-2020-2604 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2020-2604?

CVE-2020-2604 has a CVSS 3.1 base score of 8.1 (HIGH).

CVE-2020-2604

HIGH · CVSS 8.1EPSS 4.9%EU EUVD

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Key facts

CVSS score: 8.1 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-502
EPSS score: 4.9% (92th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2020-22397)
Published: January 15, 2020
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2020-22397 in the EU Vulnerability Database. Last updated in EUVD on September 30, 2024.

View on the EU Vulnerability Database

Affected products

canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
debian / debian linux
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
mcafee / epolicy orchestrator
netapp / active iq unified manager
netapp / active iq unified manager
netapp / e-series performance analyzer
netapp / e-series santricity management plug-ins
netapp / e-series santricity os controller
netapp / e-series santricity storage manager
netapp / e-series santricity web services proxy
netapp / oncommand insight
netapp / oncommand workflow automation
netapp / santricity unified manager
netapp / steelstore cloud integrated storage
opensuse / leap
oracle / commerce experience manager
oracle / commerce guided search
oracle / graalvm
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jdk
oracle / jre
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk
oracle / openjdk

and 17 more…

Certified products that may be affected

24 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active
Red Hat Enterprise Linux 8 OpenSSL Cryptographic Module - Red Hat®, Inc. - FIPS 140 4642 - historical
Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat®, Inc. - FIPS 140 4458 - historical

See all 24 in the Security Certifications Explorer.

References

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00050.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00060.html(Mailing List, Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0122(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0128(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0196(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0202(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0231(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0232(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0465(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0467(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0468(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0469(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0470(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0541(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0632(Third Party Advisory)
https://kc.mcafee.com/corporate/index?page=content&id=SB10315(Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2020/02/msg00034.html(Mailing List, Third Party Advisory)
https://seclists.org/bugtraq/2020/Feb/22(Issue Tracking, Mailing List, Third Party Advisory)
https://security.gentoo.org/glsa/202101-19(Third Party Advisory)
https://security.netapp.com/advisory/ntap-20200122-0003/(Third Party Advisory)
https://usn.ubuntu.com/4257-1/(Third Party Advisory)
https://www.debian.org/security/2020/dsa-4621(Third Party Advisory)
https://www.oracle.com/security-alerts/cpujan2020.html(Patch, Vendor Advisory)
https://www.oracle.com/security-alerts/cpujul2021.html(Patch, Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain