CVE-2025-30761: Oracle JRE Scripting RCE Vulnerability

CVE-2025-30761 Overview

CVE-2025-30761 is an insecure deserialization vulnerability affecting the Scripting component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access to compromise affected Java installations through multiple protocols, potentially resulting in unauthorized creation, deletion, or modification of critical data.

The vulnerability is particularly concerning because it can be exploited through APIs in the Scripting component, including via web services that supply data to these APIs. Additionally, this vulnerability affects Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load and run untrusted code from the internet and rely on the Java sandbox for security.

Critical Impact

Successful exploitation enables unauthorized modification or deletion of all accessible data in Oracle Java SE and GraalVM Enterprise Edition environments, bypassing security controls through the Scripting component.

Affected Products

• Oracle JRE 8u451, 8u451-perf, and 11.0.27
• Oracle JDK 8u451, 8u451-perf, and 11.0.27
• Oracle GraalVM Enterprise Edition 21.3.14

Discovery Timeline

• July 15, 2025 - CVE-2025-30761 published to NVD
• November 4, 2025 - Last updated in NVD database

Technical Details for CVE-2025-30761

Vulnerability Analysis

This vulnerability resides in the Scripting component of Oracle Java SE and GraalVM Enterprise Edition, classified as CWE-502 (Deserialization of Untrusted Data). The flaw enables attackers to submit malicious data through network-accessible APIs that interact with the Scripting engine.

While the vulnerability requires high attack complexity to exploit successfully, it does not require any privileges or user interaction. The primary impact is on data integrity, where an attacker can create, delete, or modify critical data accessible to the Java runtime. Confidentiality and availability are not directly impacted according to the vulnerability assessment.

The vulnerability affects both server-side Java deployments (through web services and APIs) and client-side deployments running sandboxed applications that process untrusted code.

Root Cause

The root cause is improper handling of deserialization operations within the Scripting component. When the Java runtime processes serialized objects through the scripting APIs, insufficient validation of the input data allows malicious payloads to be deserialized, leading to unauthorized data manipulation.

The Scripting component in affected versions does not adequately validate or sanitize objects before deserializing them, creating an attack surface for specially crafted serialized data to bypass security controls and execute operations that modify accessible data.

Attack Vector

The attack is network-based and can be executed through multiple protocols that interact with the Scripting component's APIs. Attack scenarios include:

1. Web Service Exploitation: An attacker sends crafted serialized data to a web service that passes input to the Scripting component APIs
2. Sandboxed Application Attacks: Malicious Java Web Start applications or applets loaded from untrusted sources exploit the vulnerability within the sandbox environment
3. API Manipulation: Direct interaction with exposed scripting APIs using malicious serialized payloads

The attack requires sophisticated timing and conditions to succeed, but no authentication is necessary, making internet-facing Java applications potential targets.

Detection Methods for CVE-2025-30761

Indicators of Compromise

• Unusual deserialization activity in Java application logs, particularly involving the Scripting component
• Unexpected data modifications in systems running affected Java versions
• Anomalous network traffic patterns to Java-based web services with serialized object payloads
• Evidence of sandbox escape attempts in Java Web Start or applet logs

Detection Strategies

• Monitor Java application logs for deserialization errors or exceptions related to the javax.script package
• Implement network-level inspection for suspicious serialized Java objects in HTTP/HTTPS traffic
• Deploy application-level monitoring to detect unauthorized data access or modification patterns
• Use Java agent-based solutions to track deserialization operations at runtime

Monitoring Recommendations

• Enable verbose logging for the Java Scripting component in production environments
• Configure SIEM rules to alert on deserialization-related exceptions from affected Java versions
• Monitor file system and database integrity for unauthorized modifications from Java processes
• Track outbound connections from Java applications that may indicate exploitation attempts

How to Mitigate CVE-2025-30761

Immediate Actions Required

• Identify all systems running Oracle Java SE 8u451, 8u451-perf, 11.0.27, or GraalVM Enterprise Edition 21.3.14
• Prioritize patching for internet-facing Java applications and web services
• Review and restrict network access to Java-based APIs where possible
• Disable Java Web Start and applet functionality if not required

Patch Information

Oracle has released patches addressing this vulnerability as part of the July 2025 Critical Patch Update (CPU). Organizations should apply the latest security updates from Oracle immediately.

Refer to the Oracle Security Alert July 2025 for official patch information and download links. Linux distributions such as Debian have also released corresponding updates, as noted in the Debian LTS Announcement July 2025.

Workarounds

• Implement deserialization filtering using ObjectInputFilter to restrict classes that can be deserialized
• Deploy Web Application Firewalls (WAF) with rules to inspect and block suspicious serialized Java objects
• Restrict network access to Scripting component APIs using firewall rules or network segmentation
• Disable or sandbox Java Web Start applications and applets in enterprise environments until patching is complete

# Example: Configure Java deserialization filter as a JVM argument
java -Djdk.serialFilter="!*" -jar your-application.jar

# More permissive filter allowing specific packages
java -Djdk.serialFilter="java.base/*;java.util/*;!*" -jar your-application.jar