Is CVE-2013-2465 actively exploited?

Yes. CVE-2013-2465 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2013-2465 be exploited remotely?

The attack vector of CVE-2013-2465 has not been classified yet.

What is the CVSS score of CVE-2013-2465?

CVE-2013-2465 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2013-2465

HIGHCISA KEVIN THE WILD

CVE-2013-2465

Published: March 28, 2022

EPSS:93.56%probability of exploitation in 30 daysPercentile:99.8th

Official Description

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2D

NVD Source

CISA KEV Advisory

Oracle Java SE Unspecified Vulnerability

Added to KEV: 2022-03-28Federal patch deadline: 2022-04-18⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

An unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE, related to 2D, can affect confidentiality, integrity, and availability. The high EPSS score of 0.93560 and its presence in CISA's KEV indicate a very high likelihood of active exploitation and significant risk.

This vulnerability is actively being exploited in the wild. The unspecified nature of the vectors suggests it could be remotely exploitable.

Recommended Action

Update the Java Runtime Environment (JRE) to the latest secure version. Regularly review and update all Java-dependent applications.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2013-2465 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2013-2465 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.