Exploited by the Fancy Bear APT.
This was quite useful in Pawn Storm, as it used exploits targeting these vulnerabilities to carry out targeted attacks against North Atlantic Treaty Organization (NATO) members and the White House earlier this year.
Vulnerable component: Java SE
CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
The vulnerability allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to unknown error related to the Java SE Deployment component. A remote attacker can bypass the click-to-play protection in Java.
Successful exploitation of the vulnerability results in security bypass on the vulnerable system.
Note: the vulnerability was being actively exploited.
Known APT campaigns:
NATO breach and the attacks against White House members
The attacks were performed by PawnStorm attackers.