CVE-2025-61748: Oracle GraalVM Auth Bypass Vulnerability

CVE-2025-61748 Overview

CVE-2025-61748 affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in the Libraries component. The vulnerability allows an unauthenticated attacker with network access to compromise integrity of accessible data through multiple protocols. Exploitation is difficult but requires no user interaction or privileges.

Oracle addressed the issue in the October 2025 Critical Patch Update. The flaw maps to [CWE-284: Improper Access Control]. Successful exploitation can result in unauthorized update, insert, or delete access to a subset of data handled by the affected runtime.

Critical Impact
An unauthenticated network-based attacker can perform limited unauthorized modifications to data processed by Java SE and GraalVM deployments, including sandboxed Java Web Start applications and applets that load untrusted code.

Affected Products

Oracle Java SE 21.0.8 and 25
Oracle GraalVM for JDK 21.0.8
Oracle GraalVM Enterprise Edition 21.3.15

Discovery Timeline

2025-10-21 - CVE-2025-61748 published to NVD
2025-10-21 - Oracle publishes Critical Patch Update Advisory for October 2025
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61748

Vulnerability Analysis

The defect resides in the Libraries component shared across Oracle Java SE and Oracle GraalVM distributions. According to Oracle, the vulnerability is exploitable over the network via multiple protocols without authentication. Attack complexity is high, meaning an attacker must satisfy specific preconditions to trigger the flaw.

Impact is limited to integrity. Confidentiality and availability are not affected. Successful attacks yield unauthorized update, insert, or delete access to a portion of accessible data within the affected runtime. The issue also applies to Java deployments that rely on the Java sandbox to run untrusted code, such as Java Web Start applications and applets.

The EPSS probability is 0.363% with a percentile of 29.23, indicating a low near-term exploitation likelihood at the time of publication.

Root Cause

The root cause is classified under [CWE-284: Improper Access Control] in the Libraries component. Oracle did not publish detailed technical internals in the public advisory. The weakness permits an unauthenticated caller to influence data handling paths that should enforce stricter access controls.

Attack Vector

Exploitation occurs through APIs in the Libraries component, typically reached through a web service that supplies attacker-controlled data to those APIs. Client-side exposure exists when a sandboxed application or applet loads untrusted code and depends on the Java sandbox to contain it. No user credentials are required. Because attack complexity is high, weaponization requires specific conditions in the target environment.

See the Oracle Critical Patch Update for October 2025 and Siemens Security Advisory SSA-032379 for vendor guidance.

Detection Methods for CVE-2025-61748

Indicators of Compromise

Unexpected data modifications in applications backed by vulnerable Java runtimes with no corresponding authenticated user action.
Anomalous inbound requests to web services that expose Java Libraries APIs, particularly with malformed payloads.
Execution of untrusted code within Java Web Start or applet contexts on endpoints running affected versions.

Detection Strategies

Inventory hosts running Oracle Java SE 21.0.8, 25, GraalVM for JDK 21.0.8, and GraalVM EE 21.3.15 using software asset management tooling.
Enable audit logging on Java-fronted web services and correlate write operations with authenticated session context.
Monitor egress from Java processes for unexpected outbound protocol activity that could indicate exploitation attempts against library APIs.

Monitoring Recommendations

Alert on process launches of java or javaws loading remote code from untrusted origins.
Track integrity of application databases and datastores accessed by Java services with file integrity and database audit tooling.
Subscribe to Oracle Critical Patch Update notifications to detect subsequent related advisories.

How to Mitigate CVE-2025-61748

Immediate Actions Required

Apply the Oracle October 2025 Critical Patch Update to all affected Java SE and GraalVM installations.
Identify and prioritize internet-facing web services that expose Java Libraries APIs to untrusted callers.
Disable or restrict Java Web Start and applet execution on endpoints that do not require legacy Java client functionality.

Patch Information

Oracle released fixes in the October 2025 Critical Patch Update. Administrators should upgrade to the patched releases documented in the Oracle Security Alert - October 2025. Siemens customers should also review Siemens Security Advisory SSA-032379 for product-specific remediation paths.

Workarounds

Restrict network reachability to Java services that expose Libraries-backed APIs using firewall or service mesh policies.
Enforce strict input validation and schema checks on data passed to Java web service endpoints.
Remove or disable unused Java client components, including Java Web Start, where operational requirements permit.

bash

# Verify installed Java version on Linux hosts
java -version

# Example inventory query for Java installations
find / -name 'java' -type f 2>/dev/null -exec {} -version \;