← Vulnerability Intelligence

CVE-2011-3544

Critical 9.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
97% (percentile: 100) as of 1 November 2026
CWE
CWE-284

Affected products

oracle: jdk; oracle: jre; canonical: ubuntu linux; redhat: satellite with embedded oracle; suse: linux enterprise java; suse: linux enterprise server

References