Exploitation evidence
Known exploited · CISA KEV listed
Added 2022-05-25. Ransomware campaign use: Known.
CISA required action: Apply updates per vendor instructions.
CISA due date: 2022-06-15. This is the catalog’s deadline, not an assessment of your organization’s exposure.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
n/a / n/a
Default status: Not specified
- affected: n/a
Fixes and workarounds
No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.
Sources and related reporting
CVE Program record ↗ · Download tracked evidence as JSON
- http://rhn.redhat.com/errata/RHSA-2013-0156.html
- http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:095
- http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html
- http://rhn.redhat.com/errata/RHSA-2013-0165.html
- http://www.kb.cert.org/vuls/id/625617
- http://www.us-cert.gov/cas/techalerts/TA13-010A.html
- https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf
- http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html
- https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us
- http://www.ubuntu.com/usn/USN-1693-1
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018
- http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html
- https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013
- http://seclists.org/bugtraq/2013/Jan/48
- http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html
- http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/
- http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0422
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.9708,
"percentile": 0.99892
}10 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.9708,
"percentile": 0.99892
}09 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-09",
"epss": 0.9708,
"percentile": 0.99892
}08 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-08",
"epss": 0.9708,
"percentile": 0.99892
}08 Nov 2026, 00:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:25:10.233Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2013:0156",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0156.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html"
},
{
"name": "MDVSA-2013:095",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA",
"x_transferred"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/"
},
{
"name": "openSUSE-SU-2013:0199",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html"
},
{
"name": "RHSA-2013:0165",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0165.html"
},
{
"name": "VU#625617",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/625617"
},
{
"name": "TA13-010A",
"tags": [
"third-party-advisory",
"x_refsource_CERT",
"x_transferred"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA13-010A.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us"
},
{
"name": "USN-1693-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1693-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013"
},
{
"name": "20130110 [SE-2012-01] 'Fix' for Issue 32 exploited by new Java 0-day code",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://seclists.org/bugtraq/2013/Jan/48"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2013-0422",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-10T19:51:35.331536Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2022-05-25",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0422"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-22T00:05:44.798Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-0422"
}
],
"timeline": [
{
"lang": "en",
"time": "2022-05-25T00:00:00.000Z",
"value": "CVE-2013-0422 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-01-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-02-19T14:57:03.000Z",
"orgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"shortName": "oracle"
},
"references": [
{
"name": "RHSA-2013:0156",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0156.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html"
},
{
"name": "MDVSA-2013:095",
"tags": [
"vendor-advisory",
"x_refsource_MANDRIVA"
],
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/"
},
{
"name": "openSUSE-SU-2013:0199",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html"
},
{
"name": "RHSA-2013:0165",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0165.html"
},
{
"name": "VU#625617",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/625617"
},
{
"name": "TA13-010A",
"tags": [
"third-party-advisory",
"x_refsource_CERT"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA13-010A.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us"
},
{
"name": "USN-1693-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1693-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013"
},
{
"name": "20130110 [SE-2012-01] 'Fix' for Issue 32 exploited by new Java 0-day code",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://seclists.org/bugtraq/2013/Jan/48"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert_us@oracle.com",
"ID": "CVE-2013-0422",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2013:0156",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0156.html"
},
{
"name": "http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html",
"refsource": "MISC",
"url": "http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html"
},
{
"name": "MDVSA-2013:095",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:095"
},
{
"name": "http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/",
"refsource": "MISC",
"url": "http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/"
},
{
"name": "openSUSE-SU-2013:0199",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00025.html"
},
{
"name": "RHSA-2013:0165",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0165.html"
},
{
"name": "VU#625617",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/625617"
},
{
"name": "TA13-010A",
"refsource": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA13-010A.html"
},
{
"name": "https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf",
"refsource": "MISC",
"url": "https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf"
},
{
"name": "http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html",
"refsource": "MISC",
"url": "http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html"
},
{
"name": "https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us",
"refsource": "MISC",
"url": "https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us"
},
{
"name": "USN-1693-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1693-1"
},
{
"name": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018",
"refsource": "CONFIRM",
"url": "https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018"
},
{
"name": "http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html",
"refsource": "MISC",
"url": "http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html"
},
{
"name": "https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013",
"refsource": "MISC",
"url": "https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013"
},
{
"name": "20130110 [SE-2012-01] 'Fix' for Issue 32 exploited by new Java 0-day code",
"refsource": "BUGTRAQ",
"url": "http://seclists.org/bugtraq/2013/Jan/48"
},
{
"name": "http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html",
"refsource": "CONFIRM",
"url": "http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html"
},
{
"name": "http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/",
"refsource": "MISC",
"url": "http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/"
},
{
"name": "http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/",
"refsource": "MISC",
"url": "http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85",
"assignerShortName": "oracle",
"cveId": "CVE-2013-0422",
"datePublished": "2013-01-10T21:23:00.000Z",
"dateReserved": "2012-12-07T00:00:00.000Z",
"dateUpdated": "2025-10-22T00:05:44.798Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}07 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-07",
"epss": 0.9708,
"percentile": 0.99892
}06 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-06",
"epss": 0.9708,
"percentile": 0.99892
}05 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-05",
"epss": 0.9708,
"percentile": 0.99892
}04 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-04",
"epss": 0.9708,
"percentile": 0.99892
}03 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-03",
"epss": 0.9708,
"percentile": 0.99892
}03 Nov 2026, 02:22 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-02",
"epss": 0.9708,
"percentile": 0.99892
}03 Nov 2026, 02:22 Jerusalem · CISA KEV status changed
Stored KEV snapshot at this observation.
{
"cveID": "CVE-2013-0422",
"cwes": [
"CWE-264"
],
"dateAdded": "2022-05-25",
"dueDate": "2022-06-15",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Known",
"notes": "https://nvd.nist.gov/vuln/detail/CVE-2013-0422",
"product": "Java Runtime Environment (JRE)",
"requiredAction": "Apply updates per vendor instructions.",
"shortDescription": "A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.",
"vendorProject": "Oracle",
"vulnerabilityName": "Oracle JRE Remote Code Execution Vulnerability"
}