# CVE-2025-53057: Oracle Java SE and GraalVM improper access control in Security component

Source: https://junglewise.ai/threats/cve-2025-53057-oracle-java-se-and-graalvm-improper-access-control-in-security  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-21. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2025-53057 · Severity: medium · CVSS 5.9 · Published 2025-10-21

A security vulnerability has been identified in Oracle Java SE and GraalVM products. This flaw could allow an attacker to bypass security protections to modify or delete critical data. The risk is highest for systems that run untrusted code from the internet or web services that process external data through Java APIs.

Technologies: [Oracle GraalVM Enterprise Edition](https://junglewise.ai/threats/technologies/graalvm-enterprise-edition), [Oracle Graalvm For Jdk](https://junglewise.ai/threats/technologies/graalvm-for-jdk), [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2025-53057 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-53057 being exploited in the wild.

**How severe is CVE-2025-53057?** Medium severity, with a CVSS score of 5.9, published 21 October 2025.

**Which products and versions are affected?** Debian OpenJDK 11 11.0.29+6-1~deb11u1; Oracle GraalVM Enterprise Edition 21.3.15; Oracle Graalvm For Jdk 17.0.16, 21.0.8; Oracle Java SE 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25.

**Is there a fix for CVE-2025-53057?** A patch was published on 2025-10-25: Debian released security update DLA-4346-1 for OpenJDK 11 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-53057 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-53057?** Check whether you run Debian OpenJDK 11, Oracle GraalVM Enterprise Edition, Oracle Graalvm For Jdk or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability (CWE-284) exists in the Security component of Oracle Java SE and GraalVM. The flaw is difficult to exploit and requires an unauthenticated attacker to have network access via multiple protocols. Successful exploitation allows for the unauthorized creation, deletion, or modification of data accessible to the Java runtime. This vulnerability specifically impacts Java deployments that rely on the sandbox for security (such as Java Web Start or applets) and web services that expose specific Security component APIs to external data. Debian has released updates for OpenJDK 11 to address this issue.

## Affected products

- Oracle Java SE 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25
- Oracle GraalVM for JDK 17.0.16, 21.0.8
- Oracle GraalVM Enterprise Edition 21.3.15
- Debian OpenJDK 11 11.0.29+6-1~deb11u1

## Timeline

- 2025-10-21: disclosed: Initial disclosure by Oracle
- 2025-10-21: advisory: Oracle Critical Patch Update published
- 2025-10-25: patched: Debian released security update DLA-4346-1 for OpenJDK 11

## References

- [https://www.oracle.com/security-alerts/cpuoct2025.html](https://www.oracle.com/security-alerts/cpuoct2025.html)
- [https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html](https://lists.debian.org/debian-lts-announce/2025/10/msg00026.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)

## Related threats

- [Oracle Java SE JSSE protocol handling vulnerability](https://junglewise.ai/threats/cve-2026-114820-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk)
- [Oracle Java SE JSSE remote data exposure and modification](https://junglewise.ai/threats/cve-2026-91403-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)
- [Oracle Java SE compiler vulnerability in data access](https://junglewise.ai/threats/cve-2026-91487-vulnerability-in-oracle-java-se-component-compiler-supported)
- [Oracle Java SE Java plugin sandbox escape](https://junglewise.ai/threats/cve-2026-91484-vulnerability-in-oracle-java-se-component-java-plugin-supported)
- [Oracle Java SE JGSS information disclosure](https://junglewise.ai/threats/cve-2026-91464-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)