Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
Why this VPI (explainable, experimental)
VPI breakdown
| Impact | 53.00 |
| Exploitation signal(KEV listed) | ×1.50 |
| Ransomware bonus | +5.00 |
| VPI | 84.50 |
VPI formula vpi-v1
Required Action
Apply updates per vendor instructions.
| Source | CVSS Version | Base Score | Severity | Vector String | Assessment Date |
|---|---|---|---|---|---|
| NVDNIST | 3.1 | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | 04/20/2026 |
| NVDNIST | 2.0 | 5.0 |
| AV:N/AC:L/Au:N/C:N/I:P/A:N |
| 04/20/2026 |