CVE-2012-1723Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC available

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidential…

▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)

Depth score100/ 100 · Severe

impact 53.9 · likelihood 18.7 · exploitation 25 · ransomware 5

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

Jun 16, 2012

Updated

Aug 4, 2026

CVSS

9.8

Vendor

oracle

Product

jdk

CWE

CWE-284

Depth score

100 · Severe

EPSS

94% · p100

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit availability

Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.

checked 2026-09-21

Exploit-DB

Search Exploit-DB for CVE-2012-1723 ↗

GitHub PoCs

1 public repository

EthanNJC/CVE-2012-1723 ↗

Metasploit

exploit/multi/browser/java_verifier_field_access ↗

EPSS history

Exploit-prediction probability, daily snapshots since Aug 4.

94% → 94%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 5211 days

Jun 16, 2012Published
Disclosed via NVD
Mar 3, 2022Added to CISA KEV
Federal remediation due Mar 24, 2022
Aug 4, 2026Record revised
Last analysed / modified upstream
Aug 4, 2026EPSS first tracked
94%
Sep 21, 2026Public exploit observed
Exploit-DB · 1 GitHub repo · Metasploit ×1 (last check)

oracle CWE-284 #nvd #kev #in-the-wild #exploit-available

CISA KEVKnown Exploited VulnerabilityRansomware campaign use

Added to the CISA catalog on Mar 3, 2022. Federal remediation due Mar 24, 2022. View catalog ↗

Affected

jdk <= 1.4.2_37
jdk = 1.5.0
jdk = 1.6.0
jdk = 1.7.0
jre <= 1.4.2_37
jre = 1.5.0
jre = 1.6.0
jre = 1.7.0
icedtea6 < 1.10.8
icedtea6 >= 1.11.0, < 1.11.3
enterprise_linux_desktop = 5.0
enterprise_linux_desktop = 6.0
enterprise_linux_eus = 6.2
enterprise_linux_server = 5.0
enterprise_linux_server = 6.0
enterprise_linux_server_aus = 6.2
enterprise_linux_workstation = 5.0
enterprise_linux_workstation = 6.0

Patched in

icedtea6 1.11.3

Full technical detail▾

Overview

Affected

jdk <= 1.4.2_37
jdk = 1.5.0
jdk = 1.6.0
jdk = 1.7.0
jre <= 1.4.2_37
jre = 1.5.0
jre = 1.6.0
jre = 1.7.0
icedtea6 < 1.10.8
icedtea6 >= 1.11.0, < 1.11.3
enterprise_linux_desktop = 5.0
enterprise_linux_desktop = 6.0
enterprise_linux_eus = 6.2
enterprise_linux_server = 5.0
enterprise_linux_server = 6.0
enterprise_linux_server_aus = 6.2
enterprise_linux_workstation = 5.0
enterprise_linux_workstation = 6.0

Remediation

Upgrade past the affected range:

icedtea6 1.11.3

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#kev#in-the-wild#exploit-available