CVE-2025-21587 in Java SE
Summary
by MITRE • 04/16/2025
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle GraalVM Enterprise Edition:20.3.17 and 21.3.13. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/11/2026
This vulnerability resides within the Java Secure Socket Extension component of Oracle Java SE and its related GraalVM implementations, representing a significant security weakness that affects multiple supported versions across different Java runtime environments. The flaw manifests as a difficult-to-exploit issue that permits unauthenticated network-based attacks, making it particularly concerning for systems that expose Java applications to external network traffic. The vulnerability's impact extends to both data integrity and confidentiality aspects, as attackers can potentially create, delete, or modify critical data within the affected systems. The CVSS 3.1 score of 7.4 indicates a high severity threat level that requires immediate attention from security administrators.
The technical implementation of this vulnerability involves the JavaScript Secure Socket Extension component where attackers can leverage APIs to gain unauthorized access to sensitive data and system resources. The vulnerability's exploitation pathway demonstrates how attackers can compromise systems through multiple network protocols, making it particularly dangerous in environments where Java applications handle sensitive data or operate in network-accessible configurations. The affected versions span across Java SE 8, 11, 17, 21, and 24 releases, along with corresponding GraalVM implementations, indicating this is a widespread issue affecting multiple Java runtime versions. The vulnerability's presence in both standard Java SE and GraalVM implementations suggests that organizations using either platform are at risk, regardless of their specific deployment environment.
The operational impact of this vulnerability can be severe, as successful exploitation allows attackers to achieve complete unauthorized access to all data accessible through the affected Java applications. This encompasses not only the ability to read sensitive information but also to modify or delete critical data, potentially leading to data loss or corruption. The vulnerability's applicability to sandboxed Java applications, including Java Web Start applications and applets, means that even client-side Java deployments are at risk when they execute untrusted code from external sources. Organizations running Java applications in production environments, particularly those with exposed services or applications that process sensitive data, face substantial risk from this vulnerability. The attack vector through web services that supply data to APIs indicates that this vulnerability could be exploited in scenarios where Java applications serve as backend services processing external data inputs.
Mitigation strategies should prioritize immediate patching of affected systems with the latest Oracle security updates, as this represents the most effective defense against exploitation. Organizations should also implement network segmentation and access controls to limit exposure of Java applications to untrusted networks, particularly focusing on reducing the attack surface for vulnerable services. The implementation of additional monitoring and logging mechanisms around Java application usage can help detect potential exploitation attempts. Security teams should conduct comprehensive vulnerability assessments across all Java deployments, including client-side applications, to identify and remediate affected systems. Network-based intrusion detection systems should be configured to monitor for suspicious traffic patterns that could indicate exploitation attempts. The vulnerability's classification under CWE categories related to insecure data handling and improper access control, combined with its potential mapping to ATT&CK techniques involving privilege escalation and data manipulation, underscores the need for layered security approaches. Organizations should also consider implementing application whitelisting policies and restricting Java applet execution in browser environments to reduce the attack surface for this particular vulnerability.