CVE-2002-0076: n/a vulnerability

CVE-2002-0076: Java Runtime Environment (JRE) Bytecode Verifier allows remote attackers to escape the Java sandbox and exe...

Java Runtime Environment (JRE) Bytecode Verifier allows remote attackers to escape the Java sandbox and execute commands via an applet containing an illegal cast operation, as seen in (1) Microsoft VM build 3802 and earlier as used in Internet Explorer 4.x and 5.x, (2) Netscape 6.2.1 and earlier, and possibly other implementations that use vulnerable versions of SDK or JDK, aka a variant of the "Virtual Machine Verifier" vulnerability.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 8, 2024, 02:35 UTC (UTC+00:00)

Security readout for executives and security teams

This is an old Java browser-applet sandbox escape. If a user ran a malicious applet in an affected Java virtual machine, the applet could break out of Java’s intended restrictions and execute commands. Business urgency is mainly for legacy environments, archives, kiosks, or unmanaged systems still running obsolete browser Java stacks. Likely exposure is limited to obsolete systems that still allow Java applets in vulnerable browser VM implementations. Modern environments are unlikely to be directly affected unless legacy browsers, Microsoft VM, old Netscape, or old Java SDK/JDK-derived runtimes remain in operational use. Prioritize as high only where legacy Java applet technology remains. For modern managed fleets, the priority is verification and cleanup rather than emergency response. Any confirmed affected system should be removed, isolated, or remediated using vendor guidance. Mitigation focus: Check vendor guidance in Microsoft MS02-013 and Sun security bulletin 00218.; Retire or isolate systems using Microsoft VM build 3802 or earlier.; Remove unsupported browsers that still run Java applets..

Prepared: Jun 30, 2026, 15:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2002-0076 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Apr 2, 2003, 05:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
MS02-013CVE reference · vendor-advisory, x_refsource_MS

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.