For close to 10 months, a critical vulnerability in a library found in most Java rollouts has been twisting in the wind, unpatched, and until this week without proof-of-concept exploits that people paid attention to.
https://threatpost.com/critical-java-bug-extends-to-oracle-ibm-middleware/115319/