Loading vulnerability…
CVE-2012-4681 is a remote code execution vulnerability in the Java Runtime Environment component of Oracle Java SE 7 Update 6 and earlier. The flaw allows a crafted Java applet to bypass Java sandbox and SecurityManager restrictions. The described exploitation chain abuses com.sun.beans.finder.ClassFinder.findClass together with exception handling around forName to reach restricted classes from arbitrary packages, including internal JRE classes such as those in the AWT implementation. The attack then uses reflection with a trusted immediate caller to invoke getField and access or modify private fields, defeating intended access controls. By escaping the applet sandbox, untrusted code can execute with the privileges of the logged-in user when the malicious applet is loaded in a browser with the vulnerable Java plug-in enabled.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit module (modules/exploits/multi/browser/java_jre17_exec.rb) that exploits CVE-2012-4681, a critical remote code execution vulnerability in Oracle Java 7 (JRE 1.7). The exploit abuses flaws in the ClassFinder and MethodFinder classes to disable the Java Security Manager, allowing arbitrary code execution via a malicious Java applet. The module sets up an HTTP server that serves a crafted HTML page embedding the malicious applet (Exploit.jar). When a victim visits the attacker's page with a vulnerable Java plugin enabled, the exploit is triggered, and the attacker's payload (such as a reverse shell or meterpreter) is executed on the victim's system. The module supports multiple platforms (Windows, Linux, Java) and allows for customizable payloads. The main attack vector is browser-based, requiring user interaction (visiting a malicious page). The code is weaponized, as it is part of the Metasploit framework and supports automated payload delivery and session handling.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Oracle vulnerability that CISA KEV’s knownRansomwareCampaignUse field silently flipped to Known during 2025 (evidence of ransomware campaign use).
A Java vulnerability leveraged by the exploit kit as part of a drive-by compromise chain to fetch and execute malware from the same server.
A vulnerability that became a common exploit-kit component across multiple families.
Unknown (only referenced via AV detection names; the content does not describe how it was used in the campaign).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.