CVE-2012-1723: Oracle Java SE Hotspot Improper Access Control Enables Remote Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS score is 9.8, the vulnerability is in CISA KEV with known ransomware use, and EPSS probability is extremely high, indicating active and severe risk.

What it is

CVE-2012-1723 is an unspecified vulnerability in the Hotspot component of Oracle Java SE (JRE) affecting Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier. It allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, and is classified as CWE-284 improper access control. The flaw is severe because it can be triggered without authentication or user interaction and has been exploited in the wild.

Impact

A remote attacker can fully compromise confidentiality, integrity, and availability, potentially leading to arbitrary code execution in the context of the Java process. This can result in system takeover, data theft, or service disruption.

Attack surface

The vulnerability is reachable over the network (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), likely via a crafted Java application or applet processed by the JRE. No authentication is needed to trigger the flaw.

Exploitation

CVE-2012-1723 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) with known ransomware campaign use, and EPSS indicates a 93.7% probability of exploitation in the next 30 days, confirming active exploitation.

What to do

• Apply the latest Oracle Java SE updates or the vendor patches referenced in the Oracle June 2012 CPU advisory immediately.
• Upgrade to a supported Java version and remove or disable outdated JRE versions (7u4, 6u32, 5u35, 1.4.2_37 and earlier).
• Disable Java browser plugins and restrict Java execution to trusted applications where possible.
• Apply Red Hat, Gentoo, and other vendor errata for affected Linux distributions.
• Monitor for and block exploitation attempts using network and endpoint controls.

Detection

• Monitor for unusual Java process behavior, such as spawning child processes or making unexpected network connections.
• Inspect Java applet and Web Start application execution logs for suspicious activity.
• Use endpoint detection to flag exploitation attempts targeting Hotspot or JRE components.
• Review network traffic for known exploit patterns or payloads associated with CVE-2012-1723.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.