CVE-2025-53066 is a vulnerability in the JAXP component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, affecting versions 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25, and corresponding GraalVM versions. It allows an unauthenticated attacker with network access to exploit APIs, including web services, to gain unauthorized access to critical or all accessible data within these Java environments. The vulnerability also applies to sandboxed Java Web Start applications and applets that load untrusted code relying on the Java sandbox for security. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact. Oracle's October 2025 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability for this specific CVE in the provided excerpt.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all accessible data within affected Oracle Java SE and GraalVM environments. The confidentiality of sensitive data is at high risk, while integrity and availability are not impacted according to the CVSS vector. This could compromise applications relying on these Java platforms, especially those exposing APIs or running sandboxed Java Web Start applications or applets that load untrusted code.

Oracle has included this vulnerability in its October 2025 Critical Patch Update advisory, which contains numerous security patches across Oracle products including Oracle Java SE. Customers are strongly advised to apply the October 2025 Critical Patch Update promptly to address this and other vulnerabilities. Since the vendor advisory does not explicitly confirm patch availability status for this specific CVE in the provided content, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpuoct2025.html for the latest patch and remediation instructions. No alternative mitigations or 'no action required' statements are provided by the vendor.