{"id":"CVE-2015-2590","published":"2015-07-16T10:59:17Z","modified":"2026-06-17T00:24:21Z","title":"Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability","vendor":"Oracle","product":"Java SE","tier":"core","eol":null,"description":{"text":"Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.","provenance":"source","from":"NVD"},"summary":{"text":"An unspecified flaw in the Libraries component of Oracle Java SE (versions 6u95, 7u80 and 8u45) and Java SE Embedded (versions 7u75 and 8u33) allows remote attackers to compromise confidentiality, integrity and availability. The attack requires only network access, with no authentication, no user interaction and no special configuration needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:07:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.25469,"percentile":0.97944,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2015-2590","provenance":"source"},"vulncheckKev":{"dateAdded":"2015-07-14","exploitedFirstSeen":"2015-07-14","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2015-07-14"},{"url":"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/","date":"2015-12-04"},{"url":"https://www.recordedfuture.com/russian-apt-toolkits","date":"2016-08-04"},{"url":"https://marcoramilli.com/2019/12/05/apt28-attacks-evolution/","date":"2019-12-05"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"},{"url":"https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_APT_28_4856c0a0ac.pdf","date":"2023-02-05"},{"url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/threat-landscape-report-2h-2023.pdf","date":"2024-05-06"},{"url":"https://www.logpoint.com/wp-content/uploads/2024/06/logpoint-etpr-forest-blizzard.pdf","date":"2024-05-31"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1228.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1229.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1230.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1241.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1242.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1243.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1485.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1486.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1488.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1526.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1544.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1604.html","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3316","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3339","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/75818","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032910","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2696-1","tags":["Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2706-1","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201603-11","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201603-14","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1228.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1229.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1230.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1241.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1242.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1243.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1485.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1486.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1488.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1526.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1544.html","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1604.html","tags":["Third Party Advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3316","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.debian.org/security/2015/dsa-3339","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/75818","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1032910","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2696-1","tags":["Third Party Advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2706-1","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201603-11","tags":["Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201603-14","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2590","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Exploitation of Java runtime libraries executes code","mappingType":"uncategorized","evidence":[{"from":"description","quote":"via unknown vectors related to Libraries","start":180,"end":220}],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated attack against Java SE library","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to affect confidentiality, integrity, and availability","start":101,"end":179}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-cce44880349703731cff","title":"Sofacy APT hits high profile targets with updated toolset","publisher":"securelist.com","url":"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/","date":null,"mentions":[{"quote":"The JHUHUGIT implant became a relatively popular first stage for the Sofacy attacks and was used again with a Java zero-day (CVE-2015-2590) in July 2015.","start":2033,"end":2186}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"CVE-2015-2590","start":26439,"end":26452}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-2682","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-2682","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"related","techniques":["T1189","T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2015-07-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2015-07-16","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2590","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-2682","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":2422},"priority":{"score":70.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4125 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.59,"detail":"percentile 0.9794"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}