CVE-2015-4902: Oracle Java SE Deployment integrity check bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with known exploitation and a high EPSS percentile, but the CVSS impact is limited to integrity (5.3) and the technical details are unspecified.

What it is

CVE-2015-4902 is an unspecified vulnerability in the Deployment component of Oracle Java SE 6u101, 7u85, and 8u60. It allows remote attackers to affect integrity via unknown vectors, and the record provides no further technical detail on the root cause. Because Java Deployment handles applet and Web Start execution, a bypass here can undermine the security checks that gate untrusted code.

Impact

An attacker can affect the integrity of the affected Java SE installation, potentially bypassing Deployment security checks. The record does not specify what data or code can be altered, so the exact attacker gain is unknown.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction required (AV:N/AC:L/PR:N/UI:N), so it is exploitable remotely over the network. The description says the flaw is in Deployment, but does not state the exact entry point.

Exploitation

CVE-2015-4902 is listed in CISA KEV with a due date of 2022-03-24, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.13354 (96.2nd percentile), and no ransomware campaign use is documented.

What to do

• Apply the Oracle October 2015 CPU update or later for Java SE 6u101, 7u85, and 8u60, per the vendor advisory.
• Apply the referenced Red Hat, SUSE/openSUSE, and Gentoo errata for bundled JDK/JRE packages.
• Remove or disable the Java browser plugin and Web Start where they are not required.
• Restrict outbound network access from systems running Java SE to reduce remote reachability.
• Track Java SE versions in inventory and prioritize hosts still running 6u101, 7u85, or 8u60.

Detection

• Inventory endpoints and servers for Java SE versions 6u101, 7u85, and 8u60.
• Monitor for Java Deployment or Web Start processes making unexpected outbound network connections.
• Alert on execution of untrusted JAR or JNLP content from external or user-writable locations.
• Review proxy and DNS logs for Java processes contacting untrusted hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.