Skip to main content

Oracle Java SE CVE-2025-53066

HIGH
Information Exposure (CWE-200)
2025-10-21 secalert_us@oracle.com
Authentication Bypass Java Information Disclosure Oracle Graalvm Graalvm For Jdk Jdk Jre
7.5
CVSS 3.1 · Vendor: oracle
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify internet-facing Java service
  2. Exploit
    Send crafted XML to JAXP API
  3. Execution
    Trigger information disclosure
  4. Impact
    Exfiltrate sensitive data via network response

Vulnerability Assessment

Weakness
CWE
CWE-200
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition running vulnerable versions. Exploitation requires that the target application uses JAXP APIs to process XML data from network sources, including web services accepting XML payloads, applications consuming XML from message queues or external APIs, or client-side Java Web Start/applet deployments loading untrusted code from internet sources. The AV:N/AC:L/PR:N/UI:N vector confirms no authentication, user interaction, or complex timing/race conditions are needed. Limiting factors: exploitation yields only confidentiality impact (data access) without integrity or availability compromise, scope unchanged means lateral movement to other components not directly enabled, and effectiveness depends on sensitive data being accessible to the vulnerable JAXP component's execution context.
Impact

Real-world risk is substantial due to favorable attacker conditions: CVSS vector AV:N/AC:L/PR:N/UI:N indicates network-exploitable attacks requiring no authentication, low complexity, and no user interaction against default configurations. The broad version coverage across Java 8 through 25 affects massive deployment footprints in enterprise environments. However, actual exploitation likelihood depends on exposure vectors - server-side applications using JAXP to process untrusted XML data face immediate risk, while client-side Java applets represent declining attack surface given modern browser restrictions. Oracle's description explicitly confirms exploitation through web services supplying data to JAXP APIs, suggesting realistic attack scenarios in API gateways, XML processors, and SOAP endpoints. Pure confidentiality impact (C:H/I:N/A:N) limits damage to data exfiltration without system compromise. No EPSS score, POC status, or KEV listing provided in available data, preventing probability-based risk calibration. Debian LTS and Siemens product security advisories indicate downstream vendor impact beyond Oracle's direct customers. Priority should align with XML processing exposure: critical for internet-facing services parsing external XML, moderate for internal applications with input validation, lower for pure compute workloads without JAXP usage.
Exploit ScenarioDerived

Attacker identifies internet-facing REST API or SOAP web service utilizing JAXP to parse XML payloads. Attacker crafts malicious XML document exploiting JAXP information disclosure flaw and submits via HTTP POST to vulnerable endpoint. Java application processes XML through vulnerable JAXP component, allowing attacker to exfiltrate sensitive data from server memory, configuration files, or accessible databases without authentication. No public exploit identified at time of analysis, but low attack complexity (AC:L) suggests straightforward weaponization once technical details emerge.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 12, 2026

Unauthorized data access in Oracle Java SE JAXP component allows remote unauthenticated attackers to exfiltrate sensitive information from multiple Java platforms including Oracle Java SE (8u461 through 25), GraalVM for JDK (17.0.16, 21.0.8), and GraalVM Enterprise Edition (21.3.15). Exploitation requires no authentication, low complexity, and can occur through web services supplying malicious data to JAXP APIs or via sandboxed Java Web Start/applet deployments loading untrusted code. Oracle released patches in October 2025 Critical Patch Update with EPSS data unavailable at time of analysis. CVSS 7.5 reflects pure confidentiality impact with network attack vector.

RemediationAI

Upgrade to Oracle Java SE versions released in October 2025 CPU - specific patched versions not enumerated in available data but referenced in Oracle advisory at https://www.oracle.com/security-alerts/cpuoct2025.html. For GraalVM for JDK, apply updates beyond 17.0.16 and 21.0.8 per vendor guidance. For GraalVM Enterprise Edition, upgrade from 21.3.15 to patched release per Oracle support channels. Debian LTS users should follow distribution-specific upgrade procedures at https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html. Siemens product customers should consult https://cert-portal.siemens.com/productcert/html/ssa-032379.html for embedded Java component updates. Compensating controls for environments unable to immediately patch: restrict network access to JAXP-utilizing services using firewall rules limiting exposure to trusted networks only (note this reduces but does not eliminate risk from insider threats or compromised trusted systems), implement strict XML input validation and sanitization before JAXP processing (validate schema, disable external entity processing, limit document size - effectiveness depends on accurate implementation and may not address root vulnerability), disable Java Web Start and applet support if still enabled (modern browsers already block these by default), and implement network egress monitoring for unusual data exfiltration patterns from Java processes (detective control only, does not prevent initial compromise).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability affects the JAXP (Java API for XML Processing) component, a core Java API used for parsing and transforming XML documents. JAXP provides abstraction layers over SAX, DOM, and XSLT processors. The CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) classification indicates the flaw allows information disclosure beyond intended boundaries. Affected CPE strings confirm impact across Oracle's entire Java ecosystem: standard JDK/JRE distributions (versions 8u461, 11.0.28, 17.0.16, 21.0.8, 25), GraalVM for JDK (17.0.16, 21.0.8), and GraalVM Enterprise Edition (21.3.15). The vulnerability manifests when JAXP APIs process attacker-controlled XML input, whether through web services, server-side applications consuming external data, or client-side sandboxed environments (Java Web Start, applets) designed to isolate untrusted code execution. The scope=unchanged parameter indicates compromise remains within the vulnerable component's security boundary.

Know when Java gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE HIGH
Red Hat 4.8 MEDIUM

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive ViewAI

Why It Matters

CVE-2025-53066 is a critical authentication-bypass vulnerability in Oracle Java SE's JAXP component that allows remote attackers to exfiltrate sensitive data from affected Java applications without credentials. This impacts organizations running Java SE versions 8u461-25, GraalVM 17.0.16, 21.0.8, and Enterprise Edition 21.3.15, potentially exposing confidential information through web services and Java applets with no user interaction required.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable Java Web Start and unsigned applet execution where possible; restrict network access to JAXP-consuming web services; implement input validation and sanitization on data supplied to JAXP APIs; monitor for suspicious data exfiltration patterns in application logs and network traffic.

Threat Intelligence Overview

EPSS Score
0.1%
Top 83% exploitable
Threat Intel
1
1 source
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:oracle:graalvm:21.3.15:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:17.0.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:21.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update461:*:*:-:*:*:*
cpe:2.3:a:oracle:jdk:1.8.0:update461:*:*:enterprise_performance_pack:*:*:*
cpe:2.3:a:oracle:jdk:11.0.28:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:17.0.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:21.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jdk:25:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update461:*:*:-:*:*:*
cpe:2.3:a:oracle:jre:1.8.0:update461:*:*:enterprise_performance_pack:*:*:*
cpe:2.3:a:oracle:jre:11.0.28:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:17.0.16:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:21.0.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:jre:25:*:*:*:*:*:*:*

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/5.0/x86_64/server-attestation:5.0.6.6.33.1 Affected
Container suse/manager/5.0/x86_64/server:5.0.6.7.36.2 Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.1.8.10.2 Image server-image Affected
Container suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.1.1.8.12.1 Image server-attestation-image Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-4.8 Container suse/sl-micro/6.0/toolbox:13.2-9.1 Image SL-Micro Affected
Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-134-10
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2025:18814 ADVISORY https://access.redhat.com/errata/RHSA-2025:18815 ADVISORY https://access.redhat.com/errata/RHSA-2025:18816 ADVISORY https://access.redhat.com/errata/RHSA-2025:18817 ADVISORY https://access.redhat.com/errata/RHSA-2025:18818 ADVISORY https://access.redhat.com/errata/RHSA-2025:18819 ADVISORY https://access.redhat.com/errata/RHSA-2025:18820 ADVISORY https://access.redhat.com/errata/RHSA-2025:18821 ADVISORY https://access.redhat.com/errata/RHSA-2025:18822 ADVISORY https://access.redhat.com/errata/RHSA-2025:18823 ADVISORY https://access.redhat.com/errata/RHSA-2025:18824 ADVISORY https://access.redhat.com/errata/RHSA-2025:18825 ADVISORY https://access.redhat.com/errata/RHSA-2025:18826 ADVISORY https://access.redhat.com/errata/RHSA-2025:21485 ADVISORY https://access.redhat.com/errata/RHSA-2025:22370 ADVISORY https://access.redhat.com/errata/RHSA-2025:22672 ADVISORY https://vuldb.com/vuln/329144 ADVISORY https://www.oracle.com/security-alerts/cpuoct2025.html ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21162/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21164/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3835/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3859/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3964/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3965/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3997/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4005/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4038/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4039/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:4287/ REF https://cert-portal.siemens.com/productcert/html/ssa-032379.html REF https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy