CVE-2010-0840

CRITICAL

9.8

CVSS Score

Published: April 1, 2010 at 04:00 PM UTC

Updated: June 16, 2026 at 11:16 PM UTC

3 products affected across 3 vendorsUbuntu LinuxopenSUSEJRE

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.8

Exploitation

CISA KEV

Exploit prediction

EPSS 96%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score96.3%

EPSS (Exploit Prediction Scoring System) estimates a 96.3% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.

Required Action

Apply updates per vendor instructions.

Ransomware Use

Unknown

Added to KEV

May 25, 2022

Remediation Due

Jun 15, 2022

1596 days overdue

Notes

https://nvd.nist.gov/vuln/detail/CVE-2010-0840

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."