Oracle Java SE Hotspot improper authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in Oracle Java SE. The impacted element is an unknown function of the component Hotspot. This manipulation causes improper authentication. This vulnerability appears as CVE-2025-21502. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Oracle Java SE (affected version unknown) and classified as critical. Affected by this vulnerability is an unknown functionality of the component Hotspot. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM Enterprise Edition: 20.3.16 and 21.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

It is possible to read the advisory at oracle.com. This vulnerability is known as CVE-2025-21502 since 12/25/2024. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/31/2025).

The vulnerability scanner Nessus provides a plugin with the ID 214446 (Amazon Corretto Java 17.x < 17.0.14.7.1 Vulnerability), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (214446) and CERT Bund (WID-SEC-2025-0140). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Open Source OpenJDK
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Xerox FreeFlow Print Server
• Oracle Linux
• Hitachi Configuration Manager
• SUSE openSUSE
• RESF Rocky Linux
• NetApp ActiveIQ Unified Manager
• IBM App Connect Enterprise
• Azul Zulu
• Dell NetWorker
• Hitachi Command Suite
• Hitachi Ops Center
• Dell Avamar
• Oracle Java SE
• Oracle GraalVM
• HCL BigFix

Productinfo

Type

• Programming Language Software

Vendor

• Oracle

Name

• Java SE

License

• open-source

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion