CVE-2015-2590: Oracle Java SE Libraries flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with full C/I/A impact, network reachability without authentication or interaction, and confirmed in-the-wild exploitation per CISA KEV.

What it is

CVE-2015-2590 is an unspecified vulnerability in the Libraries component of Oracle Java SE 6u95, 7u80, 8u45 and Java SE Embedded 7u75, 8u33. The record gives no root-cause detail beyond 'unknown vectors', but the CVSS 3.1 vector rates it 9.8 critical with full confidentiality, integrity and availability impact. It matters because Java is widely deployed and the flaw is remotely reachable without authentication or user interaction.

Impact

A remote attacker can fully compromise confidentiality, integrity and availability of the affected Java runtime, which in practice means arbitrary code execution in the context of the JVM. CISA's KEV entry names it a remote code execution vulnerability.

Attack surface

Reachable over the network (AV:N) with low complexity, no privileges and no user interaction (PR:N/UI:N), per the CVSS vector. The description does not specify the exact protocol or component entry point, so defenders should treat any network-exposed Java service or applet path as in scope.

Exploitation

Listed in CISA KEV since 2022-03-03 with a 2022-03-24 remediation due date, indicating known exploitation in the wild. EPSS 30-day probability is 0.25469 (97.8th percentile), and no reference carries an exploit tag, so public exploit code is not confirmed by this record.

What to do

• Apply the Oracle July 2015 CPU patches for Java SE 6u95, 7u80, 8u45 and Java SE Embedded 7u75, 8u33, or later releases.
• Apply the corresponding Linux distribution updates (Red Hat RHSA-2015-1228 through RHSA-2015-1604, Ubuntu USN-2696-1/USN-2706-1, Debian DSA-3316/DSA-3339, SUSE/openSUSE advisories, Gentoo GLSA 201603-11/14).
• Remove or upgrade end-of-life Java 6 and 7 runtimes; they are no longer receiving security fixes.
• Disable the Java browser plug-in and block untrusted applet or Web Start execution where the runtime cannot be removed.
• Restrict network exposure of Java-based services and enforce least privilege on JVM processes.

Detection

• Inventory hosts and applications still running Java 6u95, 7u80, 8u45, 7u75 or 8u33 and verify patch state against vendor advisories.
• Monitor for unexpected child processes, file writes or outbound connections spawned by java/javaw processes.
• Alert on Java applet or Web Start launches from untrusted or external origins.
• Review proxy and network logs for Java-related traffic to untrusted hosts, given the network-reachable vector.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.