CVE-2013-0422: Oracle Java 7 JMX/MBean and Reflection API sandbox bypass RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing with known ransomware use, EPSS above 97 percent and confirmed in-the-wild exploit kit exploitation make this a top-priority remote code execution flaw.

What it is

Oracle Java 7 before Update 11 contains two flaws: the public getMBeanInstantiator method in JmxMBeanServer exposes a private MBeanInstantiator that can be used with findClass to obtain arbitrary Class references, and recursion through the Reflection API bypasses the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager check because sun.reflect.Reflection.getCallerClass cannot skip new reflection API frames. Together these allow a remote attacker to escape the Java sandbox and run arbitrary code, which matters because Java 7 was widely deployed and the flaw was exploited in the wild within days of disclosure.

Impact

An attacker gains arbitrary code execution in the context of the Java process, typically the logged-in user's browser or desktop session, enabling malware installation, credential theft and lateral movement.

Attack surface

Reached remotely over the network with no authentication and no user interaction beyond loading attacker-controlled Java content, such as a malicious applet or Java Web Start application, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaws are in the Java runtime itself, not in a specific application.

Exploitation

Listed in CISA KEV (added 2022-05-25) with known ransomware campaign use, and EPSS 30-day probability is 0.97612 (99.9th percentile). References describe in-the-wild exploitation in January 2013 via the Blackhole and Nuclear Pack exploit kits, and a third party claimed the findClass/MBeanInstantiator vector was not fully fixed in Java 7 Update 11.

What to do

• Upgrade Oracle Java 7 to Update 11 or later, and apply the corresponding vendor updates for OpenJDK, Ubuntu and openSUSE; note the reported claim that the findClass/MBeanInstantiator vector may not have been fully fixed in Update 11, so verify with the latest available release.
• If Java 7 cannot be updated immediately, disable the Java browser plug-in and Java Web Start, or block Java applet execution entirely.
• Set the Java security level to the highest setting and maintain a deployment rule set or exception list that blocks untrusted applets.
• Remove or isolate legacy Java 7 installations that are no longer needed, and restrict outbound network access from systems that must run Java.
• Monitor vendor advisories for any separate CVE covering the unfixed findClass/MBeanInstantiator issue mentioned in the record.

Detection

• Hunt for Java processes spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe or /bin/sh, which is characteristic of Java exploit payloads.
• Monitor for Java applet or JNLP downloads from untrusted or newly registered domains, and for HTTP responses delivering JAR files to browsers.
• Review endpoint logs for Java 7 versions below Update 11 and for the presence of known exploit kit landing page patterns associated with Blackhole and Nuclear Pack.
• Alert on suspicious file writes or persistence creation originating from javaw.exe, java.exe or the browser plug-in process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.