Oracle GraalVM CVE-2025-61755

Exploitation targets the Compiler component of Oracle GraalVM for JDK 17.0.16 and 21.0.8 and requires network reachability to the affected JVM over one of multiple supported protocols; no authentication is needed (PR:N) and no user interaction is required (UI:N). The key limiting factor is high attack complexity (AC:H): the attacker must satisfy specific, difficult-to-control preconditions that Oracle does not disclose, which is why 'Difficult to exploit' appears in the description. Impact is bounded to unauthorized read of a subset of accessible data (C:L) with no write/integrity or availability effect, and exposure is further limited to deployments actually running these two specific GraalVM for JDK versions in a network-reachable configuration.

This is a genuinely low-priority vulnerability across nearly every signal, and the signals are mutually consistent rather than conflicting. The CVSS 3.1 base score is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable and unauthenticated (PR:N), but high attack complexity (AC:H) and only low confidentiality impact with no integrity or availability impact (C:L/I:N/A:N). EPSS reinforces this: 0.26% probability (17th percentile) indicates very low likelihood of exploitation in the wild. There is no CISA KEV listing and no public proof-of-concept, so exploitation status is 'no public exploit identified at time of analysis.' Oracle provides no SSVC decision data in this input. The one point worth flagging is a labeling mismatch: the input Tags include 'Authentication Bypass,' but the CWE is CWE-862 (Missing Authorization) and the described impact is merely unauthorized read access to a subset of data by an already-unauthenticated vector - this is an authorization/information-disclosure issue, not an authentication bypass, and the tag overstates the nature of the flaw. Note also the description's 'Difficult to exploit' language aligns with AC:H. Bottom line: a real but minor confidentiality issue appropriate for routine patch-cycle remediation, not emergency response.

A remote, unauthenticated attacker interacts with an exposed Oracle GraalVM for JDK Compiler component over one of several supported network protocols and, after satisfying difficult-to-arrange preconditions (AC:H), coaxes it into disclosing a limited subset of accessible data (C:L). No public exploit code or active exploitation is known, and the high complexity plus low impact make opportunistic mass exploitation unlikely.