CVE-2019-2699 json
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL).
published 2019-04-23 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-12338
- cvss
- 9.0
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.9%
- EPSS 2.9% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL). The supported version that is affected is Java SE: 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. While the vulnerability is in Java SE, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
Patch / fix
- oracle java_se 1.8.0_211, 8.0.211
- oracle jdk 1.8.0_211, 8.0.211
- oracle jre 1.8.0_211, 8.0.211
- sun java 1.8.0_211, 8.0.211
- sun java_se 1.8.0_211, 8.0.211
- sun jdk 1.8.0_211, 8.0.211
- sun jre 1.8.0_211, 8.0.211
- oracle openjdk 1.8.0_211, 8.0.211
- sun openjdk 1.8.0_211, 8.0.211
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
2.91% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- Oracle Corporation Java
References
-
oracle.com
/technetwork/security-advisory/cpuapr2019-5072813.html
patch, vendor-advisory
-
security.gentoo.org
/glsa/201908-10
vendor-advisory, third-party-advisory
-
support.f5.com
/csp/article/K02771314
third-party-advisory
Sources
- CVE List CVE-2019-2699
- NVD CVE-2019-2699
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Updated Java versions.