CVE-2011-3556

Oracle Java SE JDK/JRE 7/6u27/5.0u31/1.4.2_33 & JRockit R28.1.4 - RCE via RMI

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2011-3556. PoCs published by Metasploit, sk4la, mihi, hdm, including Metasploit module auxiliary/scanner/misc/java_rmi_server.

AI-analyzed exploit summary This Metasploit module exploits CVE-2011-3556 by leveraging insecure default RMI configurations to execute arbitrary Java code via remote class loading. It crafts a malicious RMI packet to trigger payload delivery over HTTP.

Description

Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.

Exploits (4)

exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/17535

This Metasploit module exploits CVE-2011-3556 by leveraging insecure default RMI configurations to execute arbitrary Java code via remote class loading. It crafts a malicious RMI packet to trigger payload delivery over HTTP.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Java RMI Registry/Activation services (default configurations)
No auth needed
Prerequisites: Network access to RMI service (default port 1099) · Target must allow remote class loading
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by sk4la · poc
https://github.com/sk4la/cve_2011_3556

This is a Python 3 implementation of a proof-of-concept exploit for CVE-2011-3556, a vulnerability in Java RMI servers. It allows remote code execution by loading a malicious JAR file from an attacker-controlled HTTP server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Java RMI server (JRE <= 1.7.0_1)
No auth needed
Prerequisites: Vulnerable Java RMI server exposed on the network · HTTP server to host the malicious JAR payload
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit SCANNER
by mihi, hdm · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/java_rmi_server.rb

This Metasploit module scans for Java RMI endpoints and checks if remote class loading is enabled, which could lead to remote code execution. It does not contain offensive payloads but detects vulnerable configurations.

Classification
Scanner 95%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Java RMI Server (versions affected by CVE-2011-3556)
No auth needed
Prerequisites: Network access to the target RMI endpoint · RMI service running on the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC EXCELLENT
by mihi · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/java_rmi_server.rb

This Metasploit module exploits a Java RMI server's insecure default configuration (CVE-2011-3556) to achieve remote code execution by leveraging the RMI Distributed Garbage Collector to load malicious classes from a remote HTTP server.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Java RMI Registry and RMI Activation services (affects most RMI endpoints)
No auth needed
Prerequisites: Network access to RMI service (default port 1099) · RMI class loader not explicitly disabled
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (24)

Core 24
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1455.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/76505
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/50231
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201406-32.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48692
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=134254866602253&w=2
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=133365109612558&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48308
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=132750579901589&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/70837
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14316
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1478.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-1384.html
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=134254957702612&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/49198
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2012-0006.html
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=133728004526190&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1026215
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1263-1
Various Sources x_refsource_confirm
http://www.ibm.com/developerworks/java/jdk/alerts/
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/597809

Scores

EPSS 0.7624
EPSS Percentile 99.5%

Details

Status published
Products (10)
oracle/jrockit r28.0.0
oracle/jrockit r28.0.1
oracle/jrockit r28.0.2
oracle/jrockit r28.1.0
oracle/jrockit r28.1.1
oracle/jrockit r28.1.3
oracle/jrockit < r28.1.4
sun/jdk 1.7.0
sun/jdk 1.6.0 (25 CPE variants)
sun/jdk 1.5.0 (17 CPE variants)
Published Oct 19, 2011
Tracked Since Feb 18, 2026