Skip to main content

Oracle Java SE CVE-2025-53057

MEDIUM
Improper Access Control (CWE-284)
2025-10-21 secalert_us@oracle.com
Authentication Bypass Java Oracle Red Hat Graalvm Graalvm For Jdk Jdk Jre Suse
5.9
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Attacker discovers exposed Java API endpoint
  2. Delivery
    Crafts multi-step API sequence targeting Security component
  3. Exploit
    Bypasses authorization checks via CWE-284 flaw
  4. Execution
    Modifies critical application data
  5. Impact
    Impact realized

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires that Java Security APIs be exposed to network-accessible callers, typically through a web service, REST endpoint, or similar interface that accepts untrusted input and passes it to vulnerable Java Security component methods without re-validating authorization. Default Java installations with APIs unexposed to the network are not at risk. The vulnerability does NOT require authentication (PR:N), but AC:H indicates the exploit path is non-trivial-likely requiring precise API call sequences, race conditions, or specific data formats. Sandboxed Java Web Start and applet deployments are vulnerable when they load untrusted code that subsequently calls affected APIs.
Impact

EPSS score of 0.07% (22nd percentile) indicates very low probability of exploitation in the wild despite the network attack vector. The CVSS vector (AC:H, PR:N, UI:N) reveals exploitation difficulty: while unauthenticated and requiring no user interaction, the attack complexity is high, likely due to specific API call sequences or race conditions required to trigger the flaw. No KEV listing or public POC confirmed at time of analysis. The integrity-only impact (I:H, C:N, A:N) means attackers cannot read or delete data directly but can modify it-a serious concern for data integrity but less critical than confidentiality or availability breaches. Real-world risk depends heavily on whether exposed Java APIs are accessible from untrusted networks; protected APIs behind authentication layers or firewalls present minimal risk. Organizations running Java in isolated environments or with strict network segmentation may treat this as lower priority than the raw CVSS suggests.
Exploit ScenarioDerived

An attacker discovers a web service backed by vulnerable Java SE that exposes Security APIs or file manipulation functions to untrusted clients. By crafting a sequence of API calls with specific parameter combinations (the high AC suggests complexity here), the attacker circumvents access control checks and modifies critical application data such as user records, configuration files, or transaction logs. The attack succeeds due to improper authorization validation in the Security component before operations execute.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Improper access control in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to create, delete, or modify critical data when APIs in the Security component are exposed via web services or similar mechanisms. The vulnerability affects Java 8u461 through 25 and carries a CVSS 5.9 with high integrity impact, though exploitation is difficult (AC:H) and no public exploit or active KEV status has been confirmed.

RemediationAI

Apply the October 2025 Oracle Critical Patch Update (CPU) as documented in https://www.oracle.com/security-alerts/cpuoct2025.html. For Java SE 8, upgrade to version 8u471 or later; Java SE 11 users should update to 11.0.29 or later; Java SE 17 users to 17.0.17 or later; Java SE 21 users to 21.0.9 or later; Java SE 25 users to 25.0.1 or later. GraalVM for JDK users should patch to the next available release. GraalVM Enterprise Edition users should contact Oracle for patched versions beyond 21.3.15. As a compensating control, restrict network access to Java applications and web services that invoke Security component APIs, limiting exposure to trusted internal networks only. Disable Java Web Start and applet functionality in browsers if not strictly required, as sandboxed deployments remain vulnerable until patched. Monitor API call patterns for unusual authorization requests.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability resides in the Security component of Oracle Java SE and its GraalVM variants, classified as CWE-284 (Improper Access Control). The flaw allows unauthorized modification of protected resources when Java APIs are invoked through external interfaces such as web services that accept untrusted input. The vulnerability applies to all Java deployment modes: standard server/desktop JVMs, GraalVM distributions, and sandboxed Java Web Start or applet environments. The network-accessible nature (AV:N) suggests the vulnerability can be triggered remotely when Java code processes data from external sources without proper authorization checks.

Know when Java gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
SUSE MEDIUM
Red Hat 5.9 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

Threat Intelligence Overview

EPSS Score
0.1%
Top 78% exploitable
Threat Intel
1
1 source
Data Quality
3 sources
Confidence: Low
NVD CVE.org EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:oracle:graalvm:21.3.15:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update461:*:*:-:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update461:*:*:enterprise_performance_pack:*:*:*
cpe:2.3:a:oracle:jdk:11.0.28:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:17.0.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:21.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:25:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update461:*:*:-:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update461:*:*:enterprise_performance_pack:*:*:*
cpe:2.3:a:oracle:jre:11.0.28:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:17.0.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:21.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:25:*:*:*:*:*:*:*

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/manager/5.0/x86_64/server-attestation:5.0.6.6.33.1 Affected
Container suse/manager/5.0/x86_64/server:5.0.6.7.36.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.1.8.10.2 Image server-image Affected
Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.1.1.8.12.1 Image server-attestation-image Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-4.8 Container suse/sl-micro/6.0/toolbox:13.2-9.1 Image SL-Micro Affected
Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-134-10
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:18814 ADVISORY https://access.redhat.com/errata/RHSA-2025:18815 ADVISORY https://access.redhat.com/errata/RHSA-2025:18816 ADVISORY https://access.redhat.com/errata/RHSA-2025:18817 ADVISORY https://access.redhat.com/errata/RHSA-2025:18818 ADVISORY https://access.redhat.com/errata/RHSA-2025:18819 ADVISORY https://access.redhat.com/errata/RHSA-2025:18820 ADVISORY https://access.redhat.com/errata/RHSA-2025:18821 ADVISORY https://access.redhat.com/errata/RHSA-2025:18822 ADVISORY https://access.redhat.com/errata/RHSA-2025:18823 ADVISORY https://access.redhat.com/errata/RHSA-2025:18824 ADVISORY https://access.redhat.com/errata/RHSA-2025:18825 ADVISORY https://access.redhat.com/errata/RHSA-2025:18826 ADVISORY https://access.redhat.com/errata/RHSA-2025:21485 ADVISORY https://access.redhat.com/errata/RHSA-2025:22370 ADVISORY https://access.redhat.com/errata/RHSA-2025:22672 ADVISORY https://vuldb.com/vuln/329143 ADVISORY https://www.oracle.com/security-alerts/cpuoct2025.html ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21162/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21164/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3835/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3859/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3964/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3965/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3997/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4005/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4038/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4039/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4287/ REF https://cert-portal.siemens.com/productcert/html/ssa-032379.html REF https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy