CVE-2011-3544: Oracle Java SE JRE Scripting flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing and EPSS near 0.97 make this a high-confidence, actively targeted remote code execution flaw wherever vulnerable Java remains deployed.

What it is

CVE-2011-3544 is an unspecified vulnerability in the Java Runtime Environment Scripting component affecting JDK and JRE 7 and 6 Update 27 and earlier. Oracle's description states that untrusted Java Web Start applications and untrusted applets can affect confidentiality, integrity and availability via unknown vectors, meaning the exact root cause is not publicly detailed. Because it is reachable from untrusted Java content and carries a CVSS 3.1 score of 9.8, it is a serious remote code execution class issue for any host still running these Java versions.

Impact

An attacker who gets a victim to load a malicious applet or Web Start application can potentially execute code with the privileges of the Java process, compromising confidentiality, integrity and availability of the host. The record does not specify the exact code execution primitive, but the CISA KEV entry names it an arbitrary code execution vulnerability.

Attack surface

Reached over the network through untrusted Java Web Start applications or untrusted Java applets loaded in a browser or Java client. The CVSS vector shows no privileges and no user interaction required (PR:N/UI:N), though in practice a victim must load the malicious Java content.

Exploitation

Listed in CISA KEV since 2022-03-03 with a required action to apply vendor updates, and EPSS 30-day probability is 0.96714 (99.883 percentile), indicating very high predicted exploitation activity. No ransomware campaign use is documented in the record.

What to do

• Apply the Oracle October 2011 CPU patch referenced in the vendor advisory, or a later Java release, to all JDK and JRE 7 and 6 Update 27 and earlier installations.
• Apply the corresponding distribution updates for Ubuntu (USN-1263-1), Red Hat, SUSE and Gentoo where Java is packaged by the OS vendor.
• Disable or remove the Java browser plugin and Java Web Start where they are not required, and block untrusted applet and JNLP content at the network and endpoint level.
• Restrict outbound and inbound Java-related traffic and enforce application allowlisting so only approved Java applications run.
• Inventory hosts and applications still bundling vulnerable Java versions, including embedded Oracle Java in products such as Red Hat Satellite, and upgrade or isolate them.

Detection

• Search endpoint inventories and software asset data for JDK/JRE versions 7 and 6 Update 27 or earlier, including embedded copies.
• Monitor for Java process spawning child processes or writing executables, which is anomalous for normal applet or Web Start behavior.
• Alert on JNLP file downloads and applet loads from untrusted or newly seen domains, and on Java plugin execution from browser processes.
• Review proxy and DNS logs for known exploit-hosting or drive-by Java exploit domains and correlate with Java user agent strings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.