{"id":"CVE-2025-50063","aliases":["BELL-CVE-2025-50063","BIT-java-2025-50063","BIT-java-min-2025-50063","BIT-jre-2025-50063","EUVD-2025-21515","GHSA-x4mx-vv42-5h8p","UBUNTU-CVE-2025-50063"],"status":"published","title":"Vulnerability in Oracle Java SE (component: Install).  Supported versions that are affected are...","description":"Vulnerability in Oracle Java SE (component: Install).   The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0029,"percentile":0.21798,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2025-07-15T19:27:35Z","modified":"2026-09-08T08:48:05Z","fixes":[{"ecosystem":"Bitnami","package":"java","fixed_in":["1.8.0","8.0.461"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"java-min","fixed_in":["1.8.0","8.0.461"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"jre","fixed_in":["1.8.0","8.0.461"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"java","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.461"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"java-min","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.461"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"jre","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.0"},{"introduced":"1.9.0"},{"fixed":"8.0.461"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"openjdk-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9~b88-1","9~b101-2ubuntu2","9~b102-1","9~b113-0ubuntu1","9~b114-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13+33-1","13.0.1+9-2","13.0.2+8-1","13.0.2+8-2","13.0.3+3-1ubuntu2","13.0.4+8-1~20.04","13.0.7+5-0ubuntu1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openjdk-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["16.0.1+9-1~20.04"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openjdk-18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18~15ea-4","18~20ea-1","18~32ea-1","18~36ea-1","18.0.2+9-2~22.04"]}],"products":[{"vendor":"oracle","product":"jdk"},{"vendor":"oracle","product":"jre"},{"vendor":"oracle corporation","product":"oracle java se"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpujul2025.html","tags":["vendor-advisory","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50063","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x4mx-vv42-5h8p"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-50063","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-50063","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-50063","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-50063","description":"Vulnerability in Oracle Java SE (component: Install).   The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","status":"published","published":"2025-07-15T19:27:35.383Z","modified":"2026-02-26T17:50:37.458Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:32:52.526476Z"}],"euvd":[{"id":"EUVD-2025-21515","description":"Vulnerability in Oracle Java SE (component: Install).   The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","status":"published","published":"2025-07-15T19:27:35Z","modified":"2026-02-26T17:50:37Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:48:19.036418Z"}],"ghsa":[{"id":"GHSA-x4mx-vv42-5h8p","title":"Vulnerability in Oracle Java SE (component: Install).  Supported versions that are affected are...","description":"Vulnerability in Oracle Java SE (component: Install).  Supported versions that are affected are Oracle Java SE: 8u451 and  8u451-perf. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","status":"published","published":"2025-07-15T21:31:40Z","modified":"2025-07-15T21:31:50Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:03:01.660442Z"}],"nvd":[{"id":"CVE-2025-50063","description":"Vulnerability in Oracle Java SE (component: Install).   The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","status":"published","published":"2025-07-15T20:15:40.85Z","modified":"2026-06-17T09:34:34.593Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:11:18.285862Z"}],"osv":[{"id":"BELL-CVE-2025-50063","title":"CVE-2025-50063 does not affect BellSoft software","status":"withdrawn","published":"2025-07-18T06:10:41.572174Z","modified":"2026-01-26T09:46:41.353521Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"UBUNTU-CVE-2025-50063","description":"Vulnerability in Oracle Java SE (component: Install).   The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","status":"published","published":"2025-07-15T20:15:00Z","modified":"2025-12-02T11:43:26.249537Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"BIT-java-2025-50063","description":"Vulnerability in Oracle Java SE (component: Install).   The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","status":"published","published":"2026-05-06T14:45:38.294Z","modified":"2026-09-08T08:48:00.690893127Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-java-min-2025-50063","description":"Vulnerability in Oracle Java SE (component: Install).   The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","status":"published","published":"2026-05-06T14:45:40.224Z","modified":"2026-09-08T08:47:56.422579243Z","updated_at":"2026-11-02T15:28:31.42203Z"},{"id":"BIT-jre-2025-50063","description":"Vulnerability in Oracle Java SE (component: Install).   The supported version that is affected is Oracle Java SE: 8u451. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE. Note: Applies to installation process on client deployment of Java. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","status":"published","published":"2026-05-08T05:47:19.959Z","modified":"2026-09-08T08:48:05.945106485Z","updated_at":"2026-11-02T15:28:31.782692Z"}]}}