CriticalCVE-2015-4902

    Oracle Java SE Integrity Check Vulnerability (CVE-2015-4902)

    Published In CISA KEV since Sources: CVE.org

    What is affected, what to do

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

    The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Oracle JDK eq 1.6.0..1.6.0
    • Oracle JDK eq 1.7.0..1.7.0
    • Oracle JDK eq 1.8.0..1.8.0
    • Oracle JRE eq 1.6.0..1.6.0
    • Oracle JRE eq 1.7.0..1.7.0
    • Oracle JRE eq 1.8.0..1.8.0
    • Red Hat Satellite eq 5.6..5.6
    • Red Hat Satellite eq 5.7..5.7
    • Redhat Enterprise Linux Desktop eq 5.0..5.0
    • Redhat Enterprise Linux Desktop eq 6.0..6.0
    • Redhat Enterprise Linux Desktop eq 7.0..7.0
    • Red Hat Enterprise Linux Extended Update Support (EUS) eq 6.7..6.7
    • Red Hat Enterprise Linux Extended Update Support (EUS) eq 7.2..7.2
    • Red Hat Enterprise Linux Extended Update Support (EUS) eq 7.3..7.3
    • Red Hat Enterprise Linux Extended Update Support (EUS) eq 7.4..7.4
    • Red Hat Enterprise Linux Extended Update Support (EUS) eq 7.5..7.5
    • Red Hat Enterprise Linux Eus Compute Node eq 7.2..7.2
    • Red Hat Enterprise Linux Eus Compute Node eq 7.3..7.3
    • Red Hat Enterprise Linux For IBM Z Systems eq 5.0_s390x..5.0_s390x
    • Red Hat Enterprise Linux For IBM Z Systems eq 6.0_s390x..6.0_s390x
    • Red Hat Enterprise Linux For IBM Z Systems eq 7.0_s390x..7.0_s390x
    • Red Hat Enterprise Linux For IBM Z Systems (Extended Update Support) eq 6.7_s390x..6.7_s390x
    • Red Hat Enterprise Linux For IBM Z Systems (Extended Update Support) eq 7.2_s390x..7.2_s390x
    • Red Hat Enterprise Linux For IBM Z Systems (Extended Update Support) eq 7.3_s390x..7.3_s390x
    • Red Hat Enterprise Linux For IBM Z Systems (Extended Update Support) eq 7.4_s390x..7.4_s390x
    • Red Hat Enterprise Linux For IBM Z Systems (Extended Update Support) eq 7.5_s390x..7.5_s390x
    • Red Hat Enterprise Linux For Power Big Endian eq 5.0_ppc..5.0_ppc
    • Red Hat Enterprise Linux For Power Big Endian eq 6.0_ppc64..6.0_ppc64
    • Red Hat Enterprise Linux For Power Big Endian eq 7.0_ppc64..7.0_ppc64
    • Red Hat Enterprise Linux For Power Big Endian Eus eq 6.7_ppc64..6.7_ppc64
    • Red Hat Enterprise Linux For Power Big Endian Eus eq 7.2_ppc64..7.2_ppc64
    • Red Hat Enterprise Linux For Power Big Endian Eus eq 7.3_ppc64..7.3_ppc64
    • Red Hat Enterprise Linux For Power Big Endian Eus eq 7.4_ppc64..7.4_ppc64
    • Red Hat Enterprise Linux For Power Big Endian Eus eq 7.5_ppc64..7.5_ppc64
    • Red Hat Enterprise Linux For Power Little Endian eq 7.0_ppc64le..7.0_ppc64le
    • Red Hat Enterprise Linux For Power Little Endian Eus eq 7.2_ppc64le..7.2_ppc64le
    • Red Hat Enterprise Linux For Power Little Endian Eus eq 7.3_ppc64le..7.3_ppc64le
    • Red Hat Enterprise Linux For Power Little Endian Eus eq 7.4_ppc64le..7.4_ppc64le
    • Red Hat Enterprise Linux For Power Little Endian Eus eq 7.5_ppc64le..7.5_ppc64le
    • Red Hat Enterprise Linux For Scientific Computing eq 6.0..6.0
    • Red Hat Enterprise Linux For Scientific Computing eq 7.0..7.0
    • Redhat Enterprise Linux Server eq 5.0..5.0
    • Redhat Enterprise Linux Server eq 6.0..6.0
    • Redhat Enterprise Linux Server eq 7.0..7.0
    • Red Hat Enterprise Linux Server From Rhui eq 5.0..5.0
    • Red Hat Enterprise Linux Server From Rhui eq 6.0..6.0
    • Red Hat Enterprise Linux Server From Rhui eq 7.0..7.0
    • Redhat Enterprise Linux Workstation eq 5.0..5.0
    • Redhat Enterprise Linux Workstation eq 6.0..6.0
    • Redhat Enterprise Linux Workstation eq 7.0..7.0
    • SUSE Linux Enterprise Module For Legacy eq 12..12
    • openSUSE Leap eq 42.1..42.1
    • OpenSUSE eq 13.2..13.2
    • SUSE Linux Enterprise Server eq 10..10
    • SUSE Linux Enterprise Server eq 11..11
    • SUSE Linux Enterprise Server eq 12..12
    • SUSE Linux Enterprise Software Development Kit (SDK) eq 11..11
    • SUSE Linux Enterprise Software Development Kit (SDK) eq 12..12

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    5.3

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: Vendor (CNA), CVSS v3

    5.3

    CVSS v3

    Severity Medium on the scale from 0 to 10.

    Source: CVE.org

    13.6 %

    EPSS score

    Elevated — model estimates 10-50% exploitation likelihood.

    Source: FIRST EPSS, percentile 96.5

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    200.92 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    5.3 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    5.3
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    13.6 %
    Elevated — model estimates 10-50% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    96.5
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary

    Response and mitigation

    Why act now?

    Prioritisation rationale

    The flaw sits in the Deployment component (browser plugin / Java Web Start), and 2015 analyses showed it could bypass the click-to-play prompt. On its own it only affects integrity and rates as moderate severity, but in practice it was used as a link in exploit chains during targeted phishing campaigns against government and defence organisations, letting further Java exploits run without user confirmation. Exploitation likelihood is still assessed as comparatively high, and CISA reports no known ransomware use. For modern client fleets without the Java plugin the risk is low. Treat legacy estates such as Internet Explorer workstations, applet-based business apps, HMI/engineering stations and kiosks running outdated JREs with the urgency of a critical finding, because Java 6/7 will receive no further security fixes.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Inventory every Java runtime via software inventory/EDR: identify Oracle JRE/JDK 1.6.0, 1.7.0 and 1.8.0, specifically builds 6u101, 7u85, 8u60 or older. Include JREs bundled with line-of-business apps, kiosks and OT engineering workstations. Example: wmic product where "Name like 'Java%'" get Name,Version or registry HKLM\SOFTWARE\JavaSoft\Java Runtime Environment.
      • Patch: the fix ships in the Oracle Critical Patch Update from October 2015 onward. Look up the exact build number in the vendor advisory. Java 6 and 7 are end-of-life without paid extended support, so migrate to a currently supported Java release rather than patching in place. On openSUSE Leap 42.1 / openSUSE 13.2, apply the distribution package updates; both releases are also EOL.
      • Disable the Java browser plugin and Java Web Start now wherever there is no hard business need: Java Control Panel → untick "Enable Java content in the browser", or enforce deployment.webjava.enabled=false plus deployment.webjava.enabled.locked through a system-wide deployment.properties.
      • Uninstall unneeded JREs, especially side-by-side legacy versions left behind by earlier updates.
      • Isolate exception hosts: systems that must stay on old JREs for compatibility go into a dedicated segment with no direct internet egress and get a documented risk acceptance.

    2. Runbook step 2

      Mitigation layers

      • Network/proxy: block downloads of .jnlp, .jar and .class files and the MIME types application/x-java-jnlp-file, application/java-archive and application/x-java-applet on the web proxy or SWG by default. Allowlist only known internal application servers.
      • Endpoint hardening (Java config): lock deployment.security.level=VERY_HIGH and deploy a signed Deployment Rule Set (DeploymentRuleSet.jar) that permits only named applets/JNLP apps and blocks everything else with action=block. This takes the click-to-play decision away from the user and centralises it.
      • Browser hardening: retire legacy browsers with NPAPI/ActiveX Java support (Internet Explorer, old Firefox ESR) via GPO/Intune, or disable Java add-ons with the "Add-on List" policy. Current Chromium and Firefox builds no longer load the plugin.
      • Application control: AppLocker/WDAC rules blocking javaws.exe and jp2launcher.exe outside approved paths or for standard users. Restrict child processes of java.exe/javaw.exe via ASR rules or EDR policy.
      • Mail gateway: quarantine attachments and links pointing to .jnlp/.jar, since delivery typically happens through crafted phishing links.

    3. Runbook step 3

      Detection rules

      • Sysmon EID 1 / Windows Security 4688 — process ancestry: browser (iexplore.exe, firefox.exe, chrome.exe) → javaws.exe/jp2launcher.exe → java.exe/javaw.exe → cmd.exe/powershell.exe/rundll32.exe. Sigma shape: ParentImage|endswith: ['\java.exe','\javaw.exe','\javaws.exe'] AND Image|endswith: ['\cmd.exe','\powershell.exe','\rundll32.exe','\regsvr32.exe'].
      • Sysmon EID 11 — file creation: java*.exe writing executables (.exe, .dll, .vbs, .ps1) to %TEMP%, %APPDATA% or autorun locations.
      • Proxy / Zeek http.log: .jnlp/.jar fetches from external, uncategorised or newly registered domains. KQL sketch: CommonSecurityLog | where RequestURL matches regex @"\.(jnlp|jar)(\?|$)" | where not(DestinationHostName in (allowlist)).
      • Network telemetry: java.exe/javaw.exe opening outbound connections to external IPs right after a browser download (correlate Sysmon EID 3 with EID 1). A JNLP fetch followed shortly by beaconing is a strong signal.
      • Inventory drift: alert when a JRE at or below 8u60 / 7u85 / 6u101 reappears on clients, e.g. via software deployment or bundling in business applications.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

    Source: cvelistv5, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    oraclejdk
    • 1.7.0
    • 1.8.0
    • 1.6.0
    • —
    • —
    • —
    oraclejre
    • 1.7.0
    • 1.6.0
    • 1.8.0
    • —
    • —
    • —
    redhatsatellite
    • 5.7
    • 5.6
    • —
    • —
    suselinux_enterprise_module_for_legacy
    • 12
    • —

    Vendors and products

    Affected operating systems

    Affected operating systems
    Linuxredhatenterprise_linux_desktop5.0
    Linuxredhatenterprise_linux_desktop6.0
    Linuxredhatenterprise_linux_desktop7.0
    Linuxredhatenterprise_linux_eus6.7
    Linuxredhatenterprise_linux_eus7.2
    Linuxredhatenterprise_linux_eus7.3
    Linuxredhatenterprise_linux_eus7.4
    Linuxredhatenterprise_linux_eus7.5
    Linuxredhatenterprise_linux_eus_compute_node7.2
    Linuxredhatenterprise_linux_eus_compute_node7.3
    Linuxredhatenterprise_linux_for_ibm_z_systems5.0_s390x
    Linuxredhatenterprise_linux_for_ibm_z_systems6.0_s390x
    Linuxredhatenterprise_linux_for_ibm_z_systems7.0_s390x
    Linuxredhatenterprise_linux_for_ibm_z_systems_eus6.7_s390x
    Linuxredhatenterprise_linux_for_ibm_z_systems_eus7.2_s390x
    Linuxredhatenterprise_linux_for_ibm_z_systems_eus7.3_s390x
    Linuxredhatenterprise_linux_for_ibm_z_systems_eus7.4_s390x
    Linuxredhatenterprise_linux_for_ibm_z_systems_eus7.5_s390x
    Linuxredhatenterprise_linux_for_power_big_endian5.0_ppc
    Linuxredhatenterprise_linux_for_power_big_endian6.0_ppc64
    Linuxredhatenterprise_linux_for_power_big_endian7.0_ppc64
    Linuxredhatenterprise_linux_for_power_big_endian_eus6.7_ppc64
    Linuxredhatenterprise_linux_for_power_big_endian_eus7.2_ppc64
    Linuxredhatenterprise_linux_for_power_big_endian_eus7.3_ppc64

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited

    References & sources

    • lists.opensuse.orgSUSE-SU-2015:2182Vendor advisory, x_refsource_SUSE, Third-party advisory
    • lists.opensuse.orgopenSUSE-SU-2015:1905Vendor advisory, x_refsource_SUSE, Third-party advisory
    • lists.opensuse.orgSUSE-SU-2015:2192Vendor advisory, x_refsource_SUSE, Third-party advisory
    • rhn.redhat.comRHSA-2015:2507Vendor advisory, x_refsource_REDHAT, Third-party advisory
    • rhn.redhat.comRHSA-2015:1928Vendor advisory, x_refsource_REDHAT, Third-party advisory
    • oracle.comtechnetwork/topics/security/cpuoct2015-2367953.htmlx_refsource_CONFIRM, Patch, Vendor advisory
    • access.redhat.comRHSA-2016:1430Vendor advisory, x_refsource_REDHAT, Third-party advisory
    • rhn.redhat.comRHSA-2015:2506Vendor advisory, x_refsource_REDHAT, Third-party advisory
    • rhn.redhat.comRHSA-2015:2509Vendor advisory, x_refsource_REDHAT, Third-party advisory
    • securitytracker.com1033884Vulnerability database, x_refsource_SECTRACK, Broken link, Third-party advisory, Vulnerability database
    • lists.opensuse.orgSUSE-SU-2015:2166Vendor advisory, x_refsource_SUSE, Third-party advisory
    • lists.opensuse.orgopenSUSE-SU-2016:0270Vendor advisory, x_refsource_SUSE, Third-party advisory
    • securityfocus.com77241Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
    • security.gentoo.orgGLSA-201603-11Vendor advisory, x_refsource_GENTOO, Third-party advisory
    • rhn.redhat.comRHSA-2015:2518Vendor advisory, x_refsource_REDHAT, Third-party advisory
    • lists.opensuse.orgSUSE-SU-2015:2216Vendor advisory, x_refsource_SUSE, Third-party advisory
    • rhn.redhat.comRHSA-2015:1927Vendor advisory, x_refsource_REDHAT, Third-party advisory
    • lists.opensuse.orgSUSE-SU-2015:2268Vendor advisory, x_refsource_SUSE, Third-party advisory
    • lists.opensuse.orgSUSE-SU-2015:2168Vendor advisory, x_refsource_SUSE, Third-party advisory
    • rhn.redhat.comRHSA-2015:1926Vendor advisory, x_refsource_REDHAT, Third-party advisory
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2015-4902
    <a href="https://intel.neosec.eu/en/cve/CVE-2015-4902"><img src="https://intel.neosec.eu/badge/cve/CVE-2015-4902.svg?lang=en" alt="CVE-2015-4902 – NEOSEC Intel" height="20"></a>