CVE-2025-53057

Root

Cause

CVE-2025-53057 is a vulnerability in the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The affected versions include Oracle Java SE 8u461, 11.0.28, 17.0.16, 21.0.8, 25, and corresponding GraalVM releases. The vulnerability is difficult to exploit and requires network access via multiple protocols, but does not require authentication [1].

Exploitation

An unauthenticated attacker with network access can exploit this vulnerability by supplying data to APIs in the affected component, for example through a web service. The attack complexity is high, meaning successful exploitation likely requires specific conditions or chaining with other weaknesses. The vulnerability can also be triggered in sandboxed Java environments, such as Java Web Start applications or applets that load untrusted code from the internet, where the Java sandbox is relied upon for security [1].

Impact

Successful exploitation of this vulnerability results in unauthorized creation, deletion, or modification of critical data accessible to Oracle Java SE or GraalVM. The CVSS v3.1 base score is 5.9 (Medium), with the vector indicating no impact to confidentiality or availability, but a high impact to integrity. An attacker could therefore corrupt or manipulate data without needing to authenticate [1].

Mitigation

Oracle has released security patches for the affected products as part of their Critical Patch Update. Users are strongly advised to apply the latest updates from Oracle. Siemens has also listed this CVE among those affecting SIMATIC CN 4100 products prior to version V5.0, indicating that the vulnerability may impact certain embedded Java environments and should be addressed by updating to the fixed version [1].