Red Hat Security Advisory: java-1.8.0-ibm security update
Affects Red HatSource GCVE Database
Mentioned vulnerabilities
Not known to be exploited.
Data as of 25 Oct 2026, 19:02 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 12% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 3 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Red Hat Product Security Red Hat | Affected
| Fixed in– |
AI-suggested
Red Hat has released an official security update upgrading IBM Java SE 8 to version 8 SR8-FP40 that addresses the vulnerabilities. Users should apply this update on Red Hat Enterprise Linux 8 systems running the java-1.8.0-ibm package after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available from Red Hat's official documentation. No additional mitigation steps are indicated in the advisory.
Description
Red Hat has released an important security update for the IBM Java SE 8 package (java-1.8.0-ibm) on Red Hat Enterprise Linux 8. This update upgrades IBM Java SE 8 to version 8 SR8-FP40 and addresses three security vulnerabilities identified by CVE-2025-21587, CVE-2025-30698, and CVE-2025-4447. The update is available for multiple architectures including x86_64, s390x, and ppc64le. Users are advised to apply this update after ensuring all previous errata have been applied. No CVSS scores are provided in the advisory, but the update is rated as having an Important security impact by Red Hat.