Deserialization in Cloud Jasperreports Io
CVE-2025-10492
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (58.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 58.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: -0.000
Affected products
- Cloud Jasperreports Io
- Cloud Jasperreports Library
- Cloud Jasperreports Server
- Cloud Jasperreports Studio
- Cloud Jasperreports Web Studio
- Jaspersoft Jasperreports Io At-Scale — versions 0
- Jaspersoft Jasperreports Io Professional — versions 0
- Jaspersoft Jasperreports Library Community Edition — versions 0
- Jaspersoft Jasperreports Library Professional — versions 0
- Jaspersoft Jasperreports Server — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- db6d2600-d19b-4111-a010-f3c4ed70cd50 (Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-10492?
- CVE-2025-10492 is a critical-severity vulnerability in Cloud Jasperreports Io, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-09-16.
- How severe is CVE-2025-10492?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2025-10492 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.