Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
CVE Vulnerability Database
Vulnerability Database/CVE-2025-21502

CVE-2025-21502: Oracle GraalVM Auth Bypass Vulnerability

CVE-2025-21502 is an authentication bypass vulnerability in Oracle GraalVM and Java SE that allows unauthorized data access. This article covers the technical details, affected versions, security impact, and mitigation.

Updated:

CVE-2025-21502 Overview

CVE-2025-21502 is an authorization flaw [CWE-863] in the Hotspot component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The vulnerability allows an unauthenticated attacker with network access via multiple protocols to compromise affected Java runtimes. Successful exploitation can yield unauthorized update, insert, or delete access to a subset of accessible data, plus unauthorized read access to a subset of data. Oracle published the issue in its Critical Patch Update advisory on January 21, 2025. The flaw also impacts Java client deployments that load and execute untrusted code through the Java sandbox.

Critical Impact

An unauthenticated remote attacker can compromise the confidentiality and integrity of data accessible to the Java runtime through APIs exposed by network-facing services, including sandboxed Java Web Start and applet workloads.

Affected Products

  • Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1
  • Oracle GraalVM for JDK: 17.0.13, 21.0.5, 23.0.1
  • Oracle GraalVM Enterprise Edition: 20.3.16, 21.3.12; Debian Linux 11; NetApp Active IQ Unified Manager, Brocade SAN Navigator, OnCommand Insight, OnCommand Workflow Automation, Bootstrap OS, and HCI Compute Node

Discovery Timeline

Technical Details for CVE-2025-21502

Vulnerability Analysis

The flaw resides in the Hotspot component, the just-in-time compiler and runtime engine shared by Oracle Java SE and the GraalVM family. It is categorized as an Incorrect Authorization weakness [CWE-863], meaning the runtime fails to enforce an expected authorization check on certain data operations. The vulnerability is difficult to exploit and requires no authentication and no user interaction. A successful attack permits limited writes and limited reads against data accessible to the targeted Java runtime, with no direct impact on availability.

Root Cause

The root cause is an authorization defect inside Hotspot logic that handles operations exposed through the Java API surface. Because the check is missing or incorrectly applied, an attacker can reach code paths that should be restricted. The same defect is reachable through the Java sandbox, allowing untrusted code such as a sandboxed applet or Web Start application to bypass restrictions on a subset of operations.

Attack Vector

Exploitation occurs over the network using multiple protocols. The most realistic delivery path is a web service that forwards attacker-controlled input to a vulnerable API in the Hotspot component. A secondary path applies to client systems that still execute sandboxed Java Web Start applications or applets retrieved from the internet. In both scenarios the attacker does not need credentials, but high attack complexity makes the exploit non-trivial to weaponize at scale.

No public proof-of-concept code, exploit module, or in-the-wild exploitation has been published for CVE-2025-21502 at the time of writing. The EPSS score is 0.2%, consistent with the absence of known weaponization. See the OpenWall OSS Security post for upstream discussion.

Detection Methods for CVE-2025-21502

Indicators of Compromise

  • No file-based or network-based indicators of compromise have been published for CVE-2025-21502. Defenders should treat detection as behavior-driven rather than signature-driven.
  • Unexpected outbound connections initiated by java or javaw processes hosting public-facing web services may warrant review.
  • Anomalous data modifications performed by service accounts associated with vulnerable Java runtimes.

Detection Strategies

  • Inventory all Java runtimes in the environment and flag any host running an Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise version listed in the Oracle advisory.
  • Monitor application logs for malformed or unexpected API payloads sent to web services backed by vulnerable JVMs.
  • Alert on Java processes that spawn unusual child processes or access files outside their normal working directories.

Monitoring Recommendations

  • Forward JVM, web application, and host process telemetry to a central data lake to allow retroactive hunting once additional indicators emerge.
  • Track patch state of all Java installations and correlate with vulnerability scanner output from authenticated scans.
  • Subscribe to vendor advisories from Oracle, Debian LTS, and NetApp for downstream updates.

How to Mitigate CVE-2025-21502

Immediate Actions Required

  • Apply the January 2025 Oracle Critical Patch Update to all affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations.
  • Update Debian 11 OpenJDK packages per the Debian LTS announcements published in January and February 2025.
  • Apply vendor updates from NetApp for Active IQ Unified Manager, Brocade SAN Navigator, OnCommand Insight, OnCommand Workflow Automation, Bootstrap OS, and HCI Compute Node.
  • Disable Java Web Start and applet execution on client systems that no longer require sandboxed legacy Java content.

Patch Information

Oracle addressed CVE-2025-21502 in the January 2025 Critical Patch Update. Fixed Java SE versions include 8u441, 11.0.26, 17.0.14, 21.0.6, and 24. GraalVM for JDK fixes ship in 17.0.14, 21.0.6, and 24. GraalVM Enterprise Edition fixes are delivered in 20.3.17 and 21.3.13. Refer to the Oracle Critical Patch Update Advisory - January 2025 for the authoritative version matrix.

Workarounds

  • Restrict network exposure of services that accept untrusted input and forward it to Java APIs by placing them behind authenticated gateways or web application firewalls.
  • Remove or disable browser plug-ins and launchers that execute sandboxed Java applets and Web Start applications from untrusted sources.
  • Enforce least-privilege service accounts for application servers so that any unauthorized write or read remains constrained to limited data.
bash
# Verify Java version and confirm the patched build is installed
java -version

# Disable Java Web Start on systems where it is no longer required (Linux example)
sudo update-alternatives --remove-all javaws || true

# On Debian 11, apply LTS security updates that include the OpenJDK fix
sudo apt-get update && sudo apt-get install --only-upgrade openjdk-17-jre-headless

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne