CVE-2009-2476: Sun Java SE

High severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days.

The Java Management Extensions (JMX) implementation in Sun Java SE 6 before Update 15, and OpenJDK, does not properly enforce OpenType checks, which allows context-dependent attackers to bypass intended access restrictions by leveraging finalizer resurrection to obtain a reference to a privileged object.

Affected products

• Sun Java SE: up to and including 6
• Sun Openjdk: any version

Published 2009-08-10. Last modified 2026-06-16.