CVE-2025-53066CWE-200information-disclosure

CVE-2025-53066

High · published October 22, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

⚡ An unauthenticated attacker can exploit this Java vulnerability just by having access to the network — it’s like leaving your front door wide open for anyone to stroll in! 🔥 Think of it as a restaurant with a secret back entrance that doesn’t check who comes in. If someone figures that out, they could walk in and swipe the chef's recipes without anyone batting an eye! If this vulnerability is exploited, attackers could gain unauthorized access to critical data, or even worse, full control over all accessible information in Oracle Java SE and GraalVM. That means sensitive data could be compromised, leading to potentially devastating consequences for your applications and users.

Put simply

Think of it as a restaurant with a secret back entrance that doesn’t check who comes in. If someone figures that out, they could walk in and swipe the chef's recipes without anyone batting an eye! This vulnerability in Oracle Java SE and GraalVM allows unauthenticated attackers with network access to bypass security measures, leveraging APIs to gain control over sensitive data. It primarily affects versions 8u461, 11.0.28, and several others, particularly in Java deployments that rely on the sandbox for security.

What to do

If this vulnerability is exploited, attackers could gain unauthorized access to critical data, or even worse, full control over all accessible information in Oracle Java SE and GraalVM. That means sensitive data could be compromised, leading to potentially devastating consequences for your applications and users. Immediate action is essential: Upgrade affected versions of Oracle Java SE and GraalVM to the latest releases. Ensure that your network configurations limit unauthenticated access and regularly audit your security policies. You've got this! Follow these steps, and you’ll be on your way to securing your Java deployments in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00694 · 52.4th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-10-22T00:20Z
Affected products (15)
ProductVersionsFixed in
oracle/graalvmall versions—
oracle/graalvm_for_jdkall versions—
oracle/graalvm_for_jdkall versions—
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jdkall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
oracle/jreall versions—
References (3)
EPSS history
Timeline
  • 21 OCT 20:03Z
    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP)
    cvelistv5