Java Zero-Day Exploit on Sale for ‘Five Digits’
Summary: An established member of an invite-only Underweb forum was selling an exploit for a previously undocumented vulnerability in Java JRE 7 Update 9, the most recent version, that lets attackers remotely seize control of systems running the software. The seller, who said the flaw resides in the Java class MidiDevice.Info and that code execution worked on all seven versions tested with Firefox and MSIE on Windows 7, set the expected offer at "five digits" and said he would sell it only once.
Bottom line: Everyone with Java installed is running a vulnerable version, and the seller's own terms - one sale, no guarantee it won't be patched, use it quickly - mean the window between purchase and exploitation is measured in days, not patch cycles.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026