Vulnerability record

CVE-2013-2423

Oracle JRE Unspecified Vulnerability

InformationalExploitation confirmedCISA KEV

What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Java Runtime Environment (JRE), fix it now.

CISA required action: Apply updates per vendor instructions.

US federal civilian agencies must remediate by Jun 15, 2022.

Patch status

Official fix available since Sep 30, 2026

Apply the vendor's update to every affected system. Check the fixed-in versions below where known.

Basis: NVD patch reference

Patch or advisory on hg.openjdk.java.net (opens in a new tab)

Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

Products affected by this vulnerability, with versions and the source of each entry
Product	Vendor	Source
Java Runtime Environment (JRE)	Oracle	KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog. Version details have not been published yet.

Intelligence timeline

Developments from the last 30 days, newest first.

CVSS scoredUpdateKEVSep 30, 2026
CVE-2013-2423 scored CVSS 3.7: Oracle Java Runtime Environment (JRE), Oracle JRE Unspecified Vulnerability
CISA lists this as exploited in the wild. Unpatched Java Runtime Environment (JRE) systems are exposed to active attacks now.
Basis: NIST National Vulnerability Database
Patch releasedUpdateKEVSep 30, 2026
Patch released for CVE-2013-2423: Oracle Java Runtime Environment (JRE), Oracle JRE Unspecified Vulnerability
An official fix is now available for Oracle Java Runtime Environment (JRE). This vulnerability is being exploited, so apply it promptly.
Basis: NVD patch reference

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2013-2423
blog.fuseyism.com http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/
blog.spiderlabs.com http://blog.spiderlabs.com/2013/04/java-is-so-confusing.html
hg.openjdk.java.net http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f
lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2013-06/msg00099.html
rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2013-0752.html
rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2013-0757.html
security.gentoo.org http://security.gentoo.org/glsa/glsa-201406-32.xml
weblog.ikvm.net http://weblog.ikvm.net/PermaLink.aspx?guid=acd2dd6d-1028-4996-95df-efa42ac237f0
exploit-db.com http://www.exploit-db.com/exploits/24976
mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2013:161
oracle.com http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
ubuntu.com http://www.ubuntu.com/usn/USN-1806-1
us-cert.gov http://www.us-cert.gov/ncas/alerts/TA13-107A
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=952398
oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16700
wiki.mageia.org https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130
cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2423