# Oracle Java vulnerabilities patched July 2025

Published: 2025-07-15 · Severity: routine
Canonical: https://vorant.io/reports/e1445f02-fa46-5cf7-9d2d-cba2e62c3923/oracle-java-vulnerabilities-patched-july-2025

> Oracle released security updates for Java on July 16, 2025; vulnerabilities allow application crashes or system compromise.

On July 16, 2025, Oracle released security updates addressing multiple vulnerabilities in Java. The specific CVE identifiers and affected versions are not detailed in this IPA advisory, which serves as a notification that patches are available rather than a technical analysis. The advisory warns that exploitation could result in application denial of service or remote code execution allowing attackers to take control of affected systems. IPA urges organizations to apply updates promptly to all supported Oracle Java releases. The advisory notes that organizations using Java for commercial purposes should review Oracle's licensing terms, which changed in April 2019, and consider obtaining vendor support.

## Detection guidance (public sample)

### Java Process Spawning Windows Command Interpreter or LOLBin

ATT&CK: T1203

A Java runtime spawning cmd, PowerShell, mshta, wscript, cscript, certutil or bitsadmin, a common post-exploitation pattern after Java client or server-side RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Windows Command Interpreter or LOLBin
description: Detects java.exe or javaw.exe spawning a command interpreter or download/execute
  LOLBin. Generic behaviour seen after successful exploitation of Java vulnerabilities
  leading to RCE, not tied to a specific CVE.
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \mshta.exe
    - \wscript.exe
    - \cscript.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Java-based build or CI tools (Jenkins, Maven, Gradle) that legitimately invoke shells
- Java application installers or updaters that run helper scripts via cmd.exe
level: medium
id: 3b2737f9-1c61-54ba-b72e-f486efb56acd
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/security/security-alert/2025/0716-jre.html
```

### Java Process Spawning Shell with Download or Reverse-Shell Command on Linux

ATT&CK: T1190

A Java process spawning a shell whose command line downloads content or opens a reverse shell, indicating possible RCE exploitation of a Java application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Shell with Download or Reverse-Shell Command on Linux
description: Detects a java process spawning sh/bash with a command line containing
  download, encoding or reverse-shell primitives. Generic indicator of RCE in a public-facing
  Java application, not tied to a specific CVE.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: /java
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - base64 -d
    - nc -e
    - mkfifo
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Java-based deployment or provisioning tools that fetch artifacts with curl or wget
  through a shell
- Application health-check scripts launched by Java services
level: high
id: 75c01eac-c960-55e1-9c92-482139e9ad2f
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/security/security-alert/2025/0716-jre.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/0716-jre.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e1445f02-fa46-5cf7-9d2d-cba2e62c3923/oracle-java-vulnerabilities-patched-july-2025.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup