This vulnerability (CVE-2025-53057) affects Oracle Java SE and Oracle GraalVM products in specific versions including Java SE 8u461 through 25, GraalVM for JDK 17.0.16 and 21.0.8, and GraalVM Enterprise Edition 21.3.15. It is a security component flaw that can be exploited by unauthenticated attackers with network access via multiple protocols to gain unauthorized ability to create, delete, or modify critical data accessible by the affected products. Exploitation can occur through APIs, such as web services that interact with these APIs, and also impacts sandboxed Java Web Start applications or applets running untrusted code. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.9, primarily affecting integrity without impacting confidentiality or availability. Oracle’s October 2025 Critical Patch Update advisory includes patches addressing this vulnerability, and Oracle strongly urges customers to apply these patches promptly to mitigate risk.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to modify critical data within Oracle Java SE and Oracle GraalVM environments. This impacts data integrity but does not affect confidentiality or availability according to the CVSS vector. The vulnerability can be exploited remotely via multiple protocols and affects Java deployments that run untrusted code relying on the Java sandbox. There are no known exploits in the wild at this time.

Oracle has released patches for this vulnerability as part of its October 2025 Critical Patch Update. Customers are strongly advised to apply the relevant patches for their affected Oracle Java SE and GraalVM versions without delay. No alternative mitigations or workarounds are specified by Oracle. Patch status is confirmed by the vendor advisory.