CVE-2015-2590

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect…

Critical9.8Known exploitedEPSS 25.5%

Published: 16 Jul 2015
Updated: 21 Oct 2025
Reserved: 20 Mar 2015
Assigned by: oracle

Description

Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.

Exploited in the wild

CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability.

Added: 3 Mar 2022
Fix due (US federal): 24 Mar 2022
Used by ransomware: Not known

Apply updates per vendor instructions.

Scores

CVSS scores of CVE-2015-2590, by who scored it
Scored by	CVSS	Score	Vector
CISA-ADPADP (enrichment)	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Analyzed	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 25.5% · top 2.0% of all CVEs (4 Nov 2026)
CISA SSVC: Exploitation: active · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

n/a
CWE-noinfo Not enough information

Affected products

n/a
- affected n/a

References (26)

RHSA-2015:1243 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html (opens in a new tab)x_refsource_CONFIRMx_transferred
75818 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
RHSA-2015:1229 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
1032910 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
USN-2706-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
RHSA-2015:1526 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2015:1485 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2015:1544 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
openSUSE-SU-2015:1289 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
RHSA-2015:1228 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
DSA-3316 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
GLSA-201603-11 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
RHSA-2015:1486 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
GLSA-201603-14 (opens in a new tab)vendor-advisoryx_refsource_GENTOOx_transferred
USN-2696-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
DSA-3339 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
RHSA-2015:1242 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2015:1488 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
SUSE-SU-2015:1319 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
SUSE-SU-2015:1320 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
openSUSE-SU-2015:1288 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
RHSA-2015:1241 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2015:1230 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
RHSA-2015:1604 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2590 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2015-2590](https://trackcve.app/badge/CVE-2015-2590.svg)](https://trackcve.app/cve/CVE-2015-2590)

Record last updated 21 Oct 2025, 23:55 UTC.