What is the CVSS score of CVE-2025-53057?

CVE-2025-53057 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2025-53057?

Yes, a patch is available for CVE-2025-53057. Update the affected software to the latest version immediately.

Oracle Java SE CVE-2025-53057

MEDIUM

Improper Access Control (CWE-284)

2025-10-21 secalert_us@oracle.com

Authentication Bypass Java Oracle Red Hat Graalvm Graalvm For Jdk Jdk Jre Suse

5.9

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 13:33 vuln.today

CVE Published

Oct 21, 2025 - 20:20 nvd

MEDIUM 5.9

DescriptionNVD

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Improper access control in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition allows unauthenticated remote attackers to create, delete, or modify critical data when APIs in the Security component are exposed via web services or similar mechanisms. The vulnerability affects Java 8u461 through 25 and carries a CVSS 5.9 with high integrity impact, though exploitation is difficult (AC:H) and no public exploit or active KEV status has been confirmed.

Technical ContextAI

This vulnerability resides in the Security component of Oracle Java SE and its GraalVM variants, classified as CWE-284 (Improper Access Control). The flaw allows unauthorized modification of protected resources when Java APIs are invoked through external interfaces such as web services that accept untrusted input. The vulnerability applies to all Java deployment modes: standard server/desktop JVMs, GraalVM distributions, and sandboxed Java Web Start or applet environments. The network-accessible nature (AV:N) suggests the vulnerability can be triggered remotely when Java code processes data from external sources without proper authorization checks.

RemediationAI

Apply the October 2025 Oracle Critical Patch Update (CPU) as documented in https://www.oracle.com/security-alerts/cpuoct2025.html. For Java SE 8, upgrade to version 8u471 or later; Java SE 11 users should update to 11.0.29 or later; Java SE 17 users to 17.0.17 or later; Java SE 21 users to 21.0.9 or later; Java SE 25 users to 25.0.1 or later. GraalVM for JDK users should patch to the next available release. GraalVM Enterprise Edition users should contact Oracle for patched versions beyond 21.3.15. As a compensating control, restrict network access to Java applications and web services that invoke Security component APIs, limiting exposure to trusted internal networks only. Disable Java Web Start and applet functionality in browsers if not strictly required, as sandboxed deployments remain vulnerable until patched. Monitor API call patterns for unusual authorization requests.