VORANT. Threat Intelligence Research Sign in Create a free account

Oracle Java vulnerabilities patched July 2025

routine vulnerability

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Oracle released security updates for Java on July 16, 2025; vulnerabilities allow application crashes or system compromise.

On July 16, 2025, Oracle released security updates addressing multiple vulnerabilities in Java. The specific CVE identifiers and affected versions are not detailed in this IPA advisory, which serves as a notification that patches are available rather than a technical analysis. The advisory warns that exploitation could result in application denial of service or remote code execution allowing attackers to take control of affected systems. IPA urges organizations to apply updates promptly to all supported Oracle Java releases. The advisory notes that organizations using Java for commercial purposes should review Oracle's licensing terms, which changed in April 2019, and consider obtaining vendor support.

Related reporting

Detection guidance

Java Process Spawning Windows Command Interpreter or LOLBin

ATT&CK T1203

A Java runtime spawning cmd, PowerShell, mshta, wscript, cscript, certutil or bitsadmin, a common post-exploitation pattern after Java client or server-side RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Process Spawning Windows Command Interpreter or LOLBin
description: Detects java.exe or javaw.exe spawning a command interpreter or download/execute
  LOLBin. Generic behaviour seen after successful exploitation of Java vulnerabilities
  leading to RCE, not tied to a specific CVE.
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Java-based build or CI tools (Jenkins, Maven, Gradle) that legitimately invoke shells
- Java application installers or updaters that run helper scripts via cmd.exe
level: medium
id: 3b2737f9-1c61-54ba-b72e-f486efb56acd
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/security/security-alert/2025/0716-jre.html

Java Process Spawning Shell with Download or Reverse-Shell Command on Linux

ATT&CK T1190

A Java process spawning a shell whose command line downloads content or opens a reverse shell, indicating possible RCE exploitation of a Java application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Java Process Spawning Shell with Download or Reverse-Shell Command on Linux
description: Detects a java process spawning sh/bash with a command line containing
  download, encoding or reverse-shell primitives. Generic indicator of RCE in a public-facing
  Java application, not tied to a specific CVE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - base64 -d
    - nc -e
    - mkfifo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Java-based deployment or provisioning tools that fetch artifacts with curl or wget
  through a shell
- Application health-check scripts launched by Java services
level: high
id: 75c01eac-c960-55e1-9c92-482139e9ad2f
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/security/security-alert/2025/0716-jre.html

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/0716-jre.html

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs