CVE-2025-10492

criticalpriority · track · 39EPSS 0.009 · 60 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.92% (60th) EPSS

CVSS 9.8 · critical

Is it mine?

24 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · cert_bund · cisa_csaf_ot

EPSS · scored 2026-10-27

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedAsset Suitecisa_csaf_ot
Update to version 9.8
MitigationAsset Suitecisa_csaf_ot
Apply general mitigation factors
MitigationEllipsecisa_csaf_ot
Since the vulnerability exists in Jasper Report component that is external to Ellipse application, restrict the loading of external custom reports created by end users by allowing only trusted Jasper reports generated by the system administrator.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.3–9.8

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary

v4.06.3mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-502USCWE-502USCWE-502US

affected products (24)

Products and version ranges known to be affected.

TIBCO JasperReports JasperReports I/O v4.0all versionscert_bundDEcpe:/a:tibco:jasperreports_server:jasperreports_io_v4.0
TIBCO JasperReports Library Professional & Jaspersoft Studio Professionalall versionscert_bundDEcpe:/a:tibco:jasperreports_server:library_professional__jaspersoft_studio_professional
TIBCO JasperReports Server v8.0all versionscert_bundDEcpe:/a:tibco:jasperreports_server:server_v8.0
TIBCO JasperReports Server v9.0all versionscert_bundDEcpe:/a:tibco:jasperreports_server:server_v9.0
TIBCO JasperReports Web Studio v3.0all versionscert_bundDEcpe:/a:tibco:jasperreports_server:web_studio_v3.0
Ellipse versions 9.0.50 and priorall versionscisa_csaf_otUS
Hitachi Energy Asset Suite≤ vers:Asset_Suite/<=9.7cisa_csaf_otUS
Hitachi Energy Ellipse≤ vers:Ellipse/<=9.0.50cisa_csaf_otUS
Jaspersoft JasperReports IO At-Scale≤ 0 ≤4.0.0enisa_euvdEU
Jaspersoft JasperReports IO Professional≤ 0 ≤4.0.0enisa_euvdEU
Jaspersoft JasperReports Library Community Edition≤ 0 ≤7.0.3enisa_euvdEU
Jaspersoft JasperReports Library Professional≤ 0 ≤9.0.2enisa_euvdEU
Jaspersoft JasperReports Server≤ 0 ≤9.0.0enisa_euvdEU
Jaspersoft JasperReports Web Studio≤ 0 ≤3.0.1enisa_euvdEU
Jaspersoft Jaspersoft Studio Community Edition≤ 0 ≤7.0.3enisa_euvdEU
Jaspersoft Jaspersoft Studio Professional≤ 0 ≤9.0.2enisa_euvdEU
cloud jasperreports io≤ 4.0.0nvdUScpe:2.3:a:cloud:jasperreports_io:*:*:*:*:*:*:*:*
cloud jasperreports library≤ 7.0.3nvdUScpe:2.3:a:cloud:jasperreports_library:*:*:*:*:*:*:*:*
cloud jasperreports library≤ 9.0.2nvdUScpe:2.3:a:cloud:jasperreports_library:*:*:*:*:*:*:*:*
cloud jasperreports server≤ 9.0.0nvdUScpe:2.3:a:cloud:jasperreports_server:*:*:*:*:*:*:*:*

showing 20 of 24

advisories (4)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-2067JasPer: Schwachstelle ermöglicht CodeausführungDeutsch2025-09-16csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in JasPer ausnutzen, um beliebigen Programmcode auszuführen.
GHSA-7c3f-cg9x-f3grJasperReports has a Java deserialisation vulnerability2025-09-16ghsa · osvUS
A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.
ICSA-26-008-01Hitachi Energy Asset Suite2025-12-09icsa · cisa_csaf_otUS
Hitachi Energy is aware of a Jasper Report vulnerability that affects the Asset Suite product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
ICSA-26-092-03Hitachi Energy Ellipse2026-02-24icsa · cisa_csaf_otUS
Hitachi Energy is aware of a Jasper Report vulnerability that affects the Ellipse product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund cisa_csaf_ot nvd osv NVD CVE.org MITRE

published 2025-09-16modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan