CVE-2025-30761

What it actually does

The flaw permits an unauthenticated network attacker to bypass authorization checks in the Scripting component, enabling unauthorized creation, deletion, or modification of critical data accessible to Oracle Java SE or GraalVM.

Why it matters to the business

Attackers could tamper with sensitive application data processed by Java deployments, causing integrity violations, compliance failures, and operational disruptions; the issue affects widely deployed LTS packages with moderate EPSS that is trending upward.

How an attack unfolds

An attacker with network access sends crafted requests via supported protocols or scripting APIs to trigger the authorization bypass in vulnerable Java SE or GraalVM instances, resulting in unauthorized data modification; exploitation is difficult and may also affect sandboxed Java Web Start or applet environments running untrusted code.

How to fix it

Upgrade affected linux-lts packages to the listed fixed versions (Alpaquita:stream to 6.6.58-r0 or 6.12.41-r0; Alpaquita:23 to 6.1.68-r0; Alpaquita:25 to 6.12.41-r0) and apply corresponding Oracle Java SE/GraalVM patches; restrict network exposure of scripting interfaces until updates are complete.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases; retest scripting API calls to verify that unauthorized data modification attempts are now blocked.

Typical attack path

1. Locate publicly reachable Oracle Java SE or GraalVM instances exposing scripting APIs
2. Craft network requests or API calls that abuse the authorization bypass
3. Perform unauthorized creation, deletion, or modification of critical data

How to detect it

Inspect application and network logs for anomalous scripting API invocations that result in unexpected data changes; correlate with traffic from untrusted sources to Java services.

What your security team should do

• Apply the exact fixed linux-lts package versions immediately given the 470 days since publication
• Limit network access to scripting components and enforce least-privilege API usage
• Monitor EPSS trend and prepare for potential increase in exploit activity