Loading vulnerability…
CVE-2011-3544 is a remote code execution vulnerability in the Scripting component of Oracle Java SE JDK/JRE 6 Update 27 and earlier and Java SE 7. The issue is widely referenced as the Java Rhino or Rhino Script Engine vulnerability and was exploitable via untrusted Java applets and Java Web Start applications. The provided context indicates exploit code abused the Rhino script engine to bypass the Java sandbox, including disabling the Java Security Manager (for example by setting it to null via reflection), after which attacker-controlled code could download and execute a native payload on the victim host. The vulnerability was heavily weaponized in exploit kits such as Blackhole, Nuclear, Sakura, Phoenix, Sweet Orange, HiMan, CritXPack, White Lotus, and Private Exploit Pack, and was also used in campaigns including Red October and Flashback-related activity.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An older Java vulnerability leveraged by Threat Group 3390 ("Emissary Panda") in watering-hole attacks to compromise victim networks.
A Java vulnerability commonly referred to as Java Rhino / Oracle Java Rhino that was widely integrated into multiple exploit kits, indicating broad criminal adoption and significance in exploit pack ecosystems.
A Java vulnerability referenced as one of the exploit options in the HiMan exploit kit, apparently used as an alternative path for older JRE 6 versions when CVE-2013-2465 crashes.
A remote code execution vulnerability in Oracle Java Applet Rhino Script Engine that allows disabling the Java Security Manager and executing a downloaded payload.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.