CVE-2013-2460: Oracle Java SE JRE Serviceability sandbox bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityIt is a remotely reachable sandbox escape with complete confidentiality, integrity and availability impact and a very high EPSS score, though it is not in KEV and the technical details are unspecified.

What it is

CVE-2013-2460 is an unspecified vulnerability in the Serviceability component of Oracle Java SE 7 Update 21 and earlier and OpenJDK 7. Oracle's own advisory gives no technical detail, but a third-party vendor claims it allows remote attackers to bypass the Java sandbox through insufficient access checks in the tracing component. Because it is a sandbox escape in a widely deployed runtime, it matters for any host running untrusted Java applets or web-start applications.

Impact

An attacker who gets code running inside the Java sandbox can escape it and gain the privileges of the JVM process, affecting confidentiality, integrity and availability of the host. In practice this means arbitrary code execution as the user running the browser or Java application.

Attack surface

The CVSS vector AV:N/AC:M/Au:N/C:C/I:C/A:C indicates it is reachable over the network with no authentication, but requires medium complexity, consistent with a victim visiting a malicious or compromised page that loads a crafted applet. Some level of user interaction (loading the applet) is implied by the vector's AC:M rating, though the record does not state this explicitly.

Exploitation

CISA KEV does not list this CVE, but EPSS gives a 30-day exploitation probability of about 0.70 (99th percentile), indicating high predicted likelihood. No reference is tagged as an exploit, so public exploit code is not confirmed by this record.

What to do

• Upgrade to a Java SE 7 release after Update 21, or to a later supported Java version, per the Oracle June 2013 CPU advisory.
• If Java cannot be updated, disable the Java browser plug-in and Java Web Start, or remove Java from endpoints that do not need it.
• Apply the corresponding OpenJDK, Red Hat, SUSE, Gentoo, Mageia and Mandriva updates where those distributions are in use.
• Enforce browser and JVM settings that block unsigned or untrusted applets and require user confirmation before execution.
• Restrict outbound network access from hosts running Java so a sandbox escape cannot easily reach attacker infrastructure.

Detection

• Monitor for Java processes spawning unexpected child processes such as cmd.exe, powershell.exe or /bin/sh, which can indicate sandbox escape.
• Alert on JVM crashes or unusual Serviceability/tracing-related log entries in Java application and browser plug-in logs.
• Hunt for outbound connections from browser or Java processes to newly registered or low-reputation domains shortly after applet load.
• Inventory endpoints still running Java SE 7 Update 21 or earlier and OpenJDK 7 builds predating the fix.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.