# CVE-2025-61748: Oracle Java SE and GraalVM improper access control in Libraries

Source: https://junglewise.ai/threats/cve-2025-61748-oracle-java-se-and-graalvm-improper-access-control-in-libraries  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-21. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2025-61748 · Severity: low · CVSS 3.7 · Published 2025-10-21

A vulnerability exists in the core libraries of Oracle Java and GraalVM, which are widely used to run enterprise applications and web services. An attacker could potentially modify or delete certain data within the application's environment. While the flaw is difficult to exploit, it poses a risk to systems that process untrusted data or run sandboxed applications, such as those used in industrial communication nodes like Siemens SIMATIC CN 4100.

Technologies: [Oracle GraalVM Enterprise Edition](https://junglewise.ai/threats/technologies/graalvm-enterprise-edition), [Oracle Graalvm For Jdk](https://junglewise.ai/threats/technologies/graalvm-for-jdk), [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se), [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-61748 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61748 being exploited in the wild.

**How severe is CVE-2025-61748?** Low severity, with a CVSS score of 3.7, published 21 October 2025.

**Which products and versions are affected?** Oracle GraalVM Enterprise Edition 21.3.15; Oracle Graalvm For Jdk 21.0.8; Oracle Java SE 21.0.8, 25; Siemens SIMATIC CN 4100 All versions < V5.0.

**Is there a fix for CVE-2025-61748?** A patch was published on 2026-05-12: Siemens released SIMATIC CN 4100 V5.0 to address the vulnerability in downstream products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61748 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-61748?** Check whether you run Oracle GraalVM Enterprise Edition, Oracle Graalvm For Jdk, Oracle Java SE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper access control vulnerability (CWE-284) exists in the Libraries component of Oracle Java SE and GraalVM. The flaw is characterized by a high attack complexity, requiring specific conditions to be met for successful exploitation. An unauthenticated attacker with network access via multiple protocols can exploit this through APIs, such as web services that supply data to the affected component. The vulnerability also impacts Java sandboxing mechanisms, potentially allowing untrusted code (e.g., from Java Web Start or applets) to bypass integrity protections. Successful exploitation results in unauthorized update, insert, or delete access to accessible data. Oracle addressed this in the October 2025 Critical Patch Update, and Siemens has released SIMATIC CN 4100 V5.0 to mitigate the downstream impact.

## Affected products

- Oracle Java SE 21.0.8, 25
- Oracle GraalVM for JDK 21.0.8
- Oracle GraalVM Enterprise Edition 21.3.15
- Siemens SIMATIC CN 4100 All versions < V5.0

## Timeline

- 2025-10-21: disclosed: Initial disclosure by Oracle
- 2025-10-21: advisory: Oracle October 2025 Critical Patch Update released
- 2026-05-12: patched: Siemens released SIMATIC CN 4100 V5.0 to address the vulnerability in downstream products

## References

- [https://www.oracle.com/security-alerts/cpuoct2025.html](https://www.oracle.com/security-alerts/cpuoct2025.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-032379.html](https://cert-portal.siemens.com/productcert/html/ssa-032379.html)

## Related threats

- [Oracle Java SE JSSE protocol handling vulnerability](https://junglewise.ai/threats/cve-2026-114820-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk)
- [Oracle Java SE JSSE remote data exposure and modification](https://junglewise.ai/threats/cve-2026-91403-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)
- [Oracle Java SE compiler vulnerability in data access](https://junglewise.ai/threats/cve-2026-91487-vulnerability-in-oracle-java-se-component-compiler-supported)
- [Oracle Java SE Java plugin sandbox escape](https://junglewise.ai/threats/cve-2026-91484-vulnerability-in-oracle-java-se-component-java-plugin-supported)
- [Oracle Java SE JGSS information disclosure](https://junglewise.ai/threats/cve-2026-91464-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)