CVE-2025-21502

What it actually does

A flaw in the Hotspot component allows an unauthenticated network attacker to bypass authorization controls, resulting in unauthorized read, update, insert, or delete access to a subset of accessible data.

Why it matters to the business

Attackers could access or modify sensitive data in Java-based applications without authentication, potentially leading to data breaches or integrity issues in affected systems across many organizations using the listed versions.

How an attack unfolds

An attacker with network access crafts requests to Java APIs in the Hotspot component, exploiting the authorization bypass to perform unauthorized data operations. This can also affect sandboxed Java applications loading untrusted code from the internet.

How to fix it

Upgrade Oracle Java SE beyond 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; GraalVM for JDK beyond 17.0.13, 21.0.5, 23.0.1; GraalVM Enterprise Edition beyond 20.3.16 and 21.3.12. For Red Hat rhel_extras_rt:7 systems, update all listed kernel-rt packages to version 0:3.10.0-327.28.2.rt56.234.el7_2.

How to confirm the fix worked

Confirm installed Java and GraalVM versions match or exceed the fixed releases; test that unauthorized data modification attempts via APIs are blocked.

Typical attack path

1. Identify network-accessible Java deployment running affected versions
2. Craft malicious API calls via multiple protocols to the Hotspot component
3. Exploit the difficult-to-trigger flaw to gain read and limited write access to data

How to detect it

Monitor application and API logs for unusual data access patterns or unauthorized modification attempts targeting Hotspot components; review network traffic to Java services for anomalous requests.

What your security team should do

• Prioritize patching all affected Java and GraalVM installations given the network attack vector
• Restrict network exposure of Java services where possible
• Review and harden sandbox configurations for untrusted code execution