Vulnerability record · CVE-2010-0840 · published 1 April 2010
CVE-2010-0840: Oracle Java SE/JRE trusted method chaining remote code execution
Oracle · Jre
CVE-2010-0840 is an unspecified vulnerability in the Java Runtime Environment component of Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25. Oracle has not confirmed the researcher claim that it stems from improper checks when executing privileged methods, allowing arbitrary code execution via an untrusted object extending a trusted class or a similar interface trust issue. It matters because a remotely reachable JRE flaw with full confidentiality, integrity, and availability impact is a serious code-execution risk.
Description
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 3.1 base score is 9.8 with network, no-privilege, no-interaction reach and full C/I/A impact, and the flaw is in CISA KEV with a very high EPSS score.
What it is
CVE-2010-0840 is an unspecified vulnerability in the Java Runtime Environment component of Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25. Oracle has not confirmed the researcher claim that it stems from improper checks when executing privileged methods, allowing arbitrary code execution via an untrusted object extending a trusted class or a similar interface trust issue. It matters because a remotely reachable JRE flaw with full confidentiality, integrity, and availability impact is a serious code-execution risk.
Impact
An attacker can execute arbitrary code in the context of the JVM, gaining full compromise of confidentiality, integrity, and availability on the affected host.
Attack surface
The CVSS vector is network-reachable with no privileges and no user interaction required, so exploitation is possible remotely over the network. The exact delivery vector is not specified in the record, but Java applets, Web Start, and other untrusted Java content are the plausible paths given the JRE component.
Exploitation
CVE-2010-0840 is listed in CISA KEV with a 2022-05-25 addition and 2022-06-15 due date, and EPSS shows a 30-day probability of 0.96319 (99.878th percentile), indicating observed exploitation and very high likelihood. No ransomware campaign use is documented.
What to do
- Apply the Oracle Java SE and Java for Business updates referenced in the March 2010 and October 2010 CPU advisories, and the vendor patches for openSUSE, Ubuntu, Red Hat, Apple, and Mandriva.
- Upgrade to a supported Java release; the affected 6 Update 18, 5.0 Update 23, and 1.4.2_25 versions are long end-of-life.
- Disable or restrict Java browser plug-in and Web Start execution where Java applets are not required.
- Remove or isolate legacy JRE installations that cannot be patched.
- Restrict outbound and inbound network access for systems that must retain Java to reduce exposure to remote exploitation.
Detection
- Monitor for unexpected child processes spawned by java.exe or java, especially command shells and scripting interpreters.
- Alert on Java processes making unusual outbound network connections or loading untrusted JARs from temporary or user-writable directories.
- Audit installed JRE versions against the affected 6 Update 18, 5.0 Update 23, and 1.4.2_25 baselines and flag any remaining instances.
- Review application and browser logs for Java applet or Web Start execution on endpoints that should not run Java content.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2010-0840 to the Known Exploited Vulnerabilities catalog on 25 May 2022 as "Oracle JRE Unspecified Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 15 June 2022.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-0840 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-0840), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
