Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6…

CVE-2011-3544 is the Rhino script engine sandbox escape in Oracle's Java Runtime Environment. The Rhino JavaScript engine bundled in JRE 6 (Update 27 and earlier) and JRE 7 (GA) exposed Java reflection through Object.getClass, letting an applet or Java Web Start app instantiate arbitrary classes and call setSecurityManager(null) — effectively turning off the sandbox. From there it's full code execution under the user account. Affected versions: JDK/JRE 7 (GA) and JDK/JRE 6 Update 27 and earlier, patched in 6u29 / 7u1 (October 2011 CPU).

The vendor 9.8 CRITICAL was *correct in 2011* — drive-by browser exploitation against unauthenticated visitors, weaponized within days by Blackhole, RedKit, and Cool EK. In 2026 the calculus is different: browsers killed the NPAPI Java plugin (Chrome in 2015, Firefox in 2017), Edge never had it, and macOS disabled Java applets by default in 2014. The bug is still real where Java runs, but the attack surface that made it 9.8 — drive-by via browser applet — is structurally gone. It survives as a server-side or kiosk-side concern only.

Why this verdict

• KEV-listed and EPSS 0.967 — the exploitation history is undeniable; this is not theoretical.
• Browser attack surface collapsed: NPAPI Java plugin removal (Chrome 2015, Firefox 2017) eliminated the drive-by vector that made the original 9.8 stick. Downward pressure: −1.0.
• User-context impact only: chain ends at user-token RCE, not SYSTEM. No kernel or domain pivot inherent to the bug. Downward pressure: −0.4.
• Role multiplier: JRE is overwhelmingly deployed on workstations and middleware app servers — *not* a hypervisor, IdP, CA, or kernel-mode agent. Worst-realistic role is a build server or CI runner with privileged service account still on JRE 6/7 — chain there yields credential theft, but installed base of that profile is well under 1% in 2026. Floor remains HIGH, not CRITICAL.
• KEV listing is a hard floor: regardless of friction, an actively-exploited bug with public Metasploit modules cannot drop below HIGH while the catalog entry stands.

Why not higher?

The original 9.8 CRITICAL assumed a populated browser-plugin ecosystem that no longer exists. Default-modern browsers cannot load the applets that delivered this in 2011–2014. CRITICAL would require fleet-scale exposure today, and the affected JRE versions are residual rather than mainstream.

Why not lower?

KEV status, an EPSS of 0.96714, and a working Metasploit module published over a decade ago mean any unpatched host is one Java Web Start launch from RCE. MEDIUM would imply this is theoretical or hard to exploit — it is neither. Hosts still on JRE 6u27 in 2026 are almost certainly under-managed and under-monitored, raising real-world risk per host.

1. Uninstall Oracle JRE 6 and JRE 7 GA from all endpoints — These versions have been out of public support for years. Use SCCM/Intune/Jamf to enumerate and remove. Per the noisgate HIGH mitigation SLA, complete within 30 days.
2. Block javaw.exe and javaws.exe launches from user-writable paths via AppLocker/WDAC — Even if a residual JRE exists, allowlisting prevents Java Web Start abuse. Deploy via GPO within 30 days alongside the inventory sweep.
3. Disable Java browser plugin where Java is still required for thick clients — Set deployment.webjava.enabled=false in deployment.properties. Decouples residual JRE from any browser-reachable surface immediately.
4. Migrate any remaining Java workload to Eclipse Temurin 17/21 LTS or Azul Zulu — Modern OpenJDK builds removed Rhino in favor of Nashorn (then GraalJS) and enforce module-system access checks. Plan within the 180-day noisgate remediation SLA.
5. EDR rule: alert on javaw.exe → cmd.exe/powershell.exe/wscript.exe — Catches post-exploit stage of this and many other Java RCEs. Deploy in detect-then-block mode within 30 days.

Run on the target Windows endpoint with local admin to enumerate installed Oracle JRE/JDK versions. Invoke as: powershell -ExecutionPolicy Bypass -File Check-CVE-2011-3544.ps1. Exits 1 if a vulnerable JRE/JDK is present, 0 if clean, 2 if no Java found.

# Check-CVE-2011-3544.ps1
# Detects Oracle JRE/JDK <= 6u27 or 7 GA (CVE-2011-3544 / Rhino sandbox escape)
# Output: VULNERABLE | PATCHED | UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$found = @()

$uninstallKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

foreach ($k in $uninstallKeys) {
    Get-ItemProperty $k | Where-Object {
        $_.DisplayName -match 'Java(\(TM\))?\s*(SE\s*)?(Runtime Environment|Development Kit)' -or
        $_.Publisher -match 'Oracle|Sun Microsystems'
    } | ForEach-Object {
        $found += [PSCustomObject]@{
            Name    = $_.DisplayName
            Version = $_.DisplayVersion
            Path    = $_.InstallLocation
        }
    }
}

if (-not $found) {
    Write-Output 'UNKNOWN: no Oracle Java install detected'
    exit 2
}

$vulnerable = $false
foreach ($j in $found) {
    $v = $j.Version
    # Match patterns like 6.0.270, 1.6.0_27, 7.0.0
    if ($v -match '^(1\.)?6.*?(_| )(\d{1,2})$') {
        $upd = [int]$Matches[3]
        if ($upd -le 27) { $vulnerable = $true; Write-Output ("VULNERABLE: {0} {1}" -f $j.Name,$v) }
    }
    elseif ($v -match '^(1\.)?7\.0[\._ ]0?$' -or $v -eq '7.0.0' -or $v -match '^7\s*$') {
        $vulnerable = $true
        Write-Output ("VULNERABLE: {0} {1}" -f $j.Name,$v)
    }
    else {
        Write-Output ("PATCHED-or-newer: {0} {1}" -f $j.Name,$v)
    }
}

if ($vulnerable) { exit 1 } else { exit 0 }

Sources

1. NVD — CVE-2011-3544
2. Oracle CPU October 2011
3. CISA KEV Catalog
4. Metasploit module — java_rhino
5. Red Hat advisory RHSA-2011:1380
6. Mozilla — end of NPAPI plugin support
7. Krebs on Security — Blackhole Exploit Kit analysis
8. Michael Schierl — Java exploit research