What is CVE-2015-4902?

CVE-2015-4902 is a medium-severity vulnerability in Oracle Jdk, classified under Improper Access Control. CVSS score: 5.3/10. Published 2015-10-22.

How severe is CVE-2015-4902?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2015-4902 known to be exploited?

Yes. CVE-2015-4902 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating it is being actively exploited. 3 public proof-of-concept repositories are indexed.

Vulnerability in Oracle Jdk

CVE-2015-4902

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

Published 2015-10-22 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.136 (96.4th percentile), scored 2026-10-18.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.136 · newest: 0.136 · change: 0.000

Affected products

Oracle Jdk — versions 1.6.0, 1.7.0, 1.8.0
Oracle Jre — versions 1.6.0, 1.7.0, 1.8.0
openSUSE Leap — versions 42.1
openSUSE — versions 13.2
Red Hat Enterprise Linux Desktop — versions 5.0, 6.0, 7.0
Red Hat Enterprise Linux Eus — versions 6.7, 7.2, 7.3
Red Hat Enterprise Linux Eus Compute Node — versions 7.2, 7.3
Red Hat Enterprise Linux For IBM Z Systems — versions 5.0_s390x, 6.0_s390x, 7.0_s390x
Red Hat Enterprise Linux For IBM Z Systems Eus — versions 6.7_s390x, 7.2_s390x, 7.3_s390x
Red Hat Enterprise Linux For Power Big Endian — versions 5.0_ppc, 6.0_ppc64, 7.0_ppc64

Weakness classification (CWE)

CWE-284 — Improper Access Control

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2022-03-03. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2022-03-24.

Required action: Apply updates per vendor instructions.

Public proof-of-concept exploits

References

lists.opensuse.org/opensuse-security-announce/2015-12/msg00003.html (vendor-advisory, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2015-11/msg00009.html (vendor-advisory, Third Party Advisory)
lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html (vendor-advisory, Third Party Advisory)
rhn.redhat.com/errata/RHSA-2015-2507.html (vendor-advisory, Third Party Advisory)
rhn.redhat.com/errata/RHSA-2015-1928.html (vendor-advisory, Third Party Advisory)
www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html (Patch, Vendor Advisory)
access.redhat.com/errata/RHSA-2016:1430 (vendor-advisory, Third Party Advisory)
rhn.redhat.com/errata/RHSA-2015-2506.html (vendor-advisory, Third Party Advisory)
rhn.redhat.com/errata/RHSA-2015-2509.html (vendor-advisory, Third Party Advisory)
www.securitytracker.com/id/1033884 (VDB Entry, Third Party Advisory, vdb-entry, Broken Link)

Frequently asked questions

What is CVE-2015-4902?: CVE-2015-4902 is a medium-severity vulnerability in Oracle Jdk, classified under Improper Access Control. CVSS score: 5.3/10. Published 2015-10-22.
How severe is CVE-2015-4902?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2015-4902 known to be exploited?: Yes. CVE-2015-4902 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-03-03), indicating it is being actively exploited. 3 public proof-of-concept repositories are indexed.