CVE-2015-4748: Oracle Java SE Security component unspecified flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityNetwork-reachable, no authentication required, full C/I/A impact, and a very high EPSS percentile, though the flaw is old and no in-the-wild exploitation is confirmed in this record.

What it is

CVE-2015-4748 is an unspecified vulnerability in the Security component of Oracle Java SE 6u95, 7u80, and 8u45, JRockit R28.3.6, and Java SE Embedded 7u75 and 8u33. Oracle's July 2015 CPU addressed it, but the record gives no root-cause detail, so the exact mechanism is unknown. It matters because a remotely reachable flaw in Java's security layer can compromise confidentiality, integrity, and availability.

Impact

A remote attacker could affect confidentiality, integrity, and availability of the affected Java runtime, potentially leading to full compromise of the Java process. The record does not specify what data or code execution is gained.

Attack surface

The CVSS 2.0 vector AV:N/AC:H/Au:N indicates network reachability with no authentication required, but high access complexity. No user interaction is stated in the record; the description only says unknown vectors related to Security.

Exploitation

Not listed in CISA KEV and no reference carries an exploit tag, so there is no confirmed in-the-wild exploitation in this record. EPSS is 0.4487 (98.7th percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

• Apply the Oracle July 2015 Critical Patch Update or the corresponding vendor errata (Red Hat RHSA, Debian DSA, Ubuntu USN, SUSE) for the affected Java versions.
• Upgrade to a supported Java release; 6u95, 7u80, 8u45, JRockit R28.3.6, and the listed Embedded builds are long out of support.
• Disable or restrict the Java browser plugin and Java Web Start where not required, and limit outbound network access from Java processes.
• Inventory Java/JRE/JDK and JRockit installations across servers and endpoints and remove unsupported versions.
• Monitor vendor advisories for any later clarification of the flaw, since the root cause is unspecified.

Detection

• Search asset inventories and package lists for Java 6u95, 7u80, 8u45, JRockit R28.3.6, Embedded 7u75, and Embedded 8u33.
• Alert on Java processes making unexpected outbound network connections or spawning unusual child processes.
• Correlate endpoint and server logs for Java-related crashes or anomalous Security component behavior around patch windows.
• Track EPSS and KEV updates for this CVE to catch any change in exploitation status.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.