Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
  • Support the projectPage
Back

CVE-2010-0840

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23,…

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to improper checks when executing privileged methods in the Java Runtime Environment (JRE), which allows attackers to execute arbitrary code via (1) an untrusted object that extends the trusted class but has not modified a certain method, or (2) "a similar trust issue with interfaces," aka "Trusted Methods Chaining Remote Code Execution Vulnerability."

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Oracle JRE Unspecified Vulnerability.

Added
25 May 2022
Fix due (US federal)
15 Jun 2022
Used by ransomware
Not known

Apply updates per vendor instructions.

ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 25 May 2022.

Public exploit

An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Metasploit module and an Exploit-DB entry for it. CISA's SSVC rates its exploitation: it is being exploited.

Show the exploits2

Metasploit modules1 module

Exploit-DB1 entry

Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from

Timeline

  1. ID reserved

    By oracle

  2. · 29 days later

    Published

  3. · 12 years later

    Added to CISA KEV

    Known exploited in the wild

  4. · 3 years later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2010-0840, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
96.3% · top 0.1% of all CVEs (9 Nov 2026)
CISA SSVC
Exploitation: active · Automatable: yes · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Affected products

  • n/a

    • affected n/a

References

41

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2010-0840 badge
[![CVE-2010-0840](https://cveledger.app/badge/CVE-2010-0840.svg)](https://cveledger.app/cve/CVE-2010-0840)

Record last updated .