CVE-2025-10492: cloud jasperreports_io Deserialization of Untrusted Data
CVSS: 9.8v3.1CriticalModified
AliasesUBUNTU-CVE-2025-10492GHSA-7c3f-cg9x-f3gr
Published 16-09-2025Last modified 10-02-2026
Vulnerability summary
CVE-2025-10492 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in cloud jasperreports_io. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.7% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.92%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 16-09-2025PublishedVulnerability first disclosed.
- 10-02-2026Last modifiedVulnerability information updated.
Description
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
CVSS metrics
7 scores · 4 sources · 2 versionsHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · MavenEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
+0.01 pp
From 0.91% on 19-09-2026
19-09-202619-10-2026
EPSS score0.92%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Jaspersoft8 products
- jasperreports io at-scale≤ 4.0.0
- jasperreports io professional≤ 4.0.0
- jasperreports library community edition≤ 7.0.3
- jasperreports library professional≤ 9.0.2
- jasperreports server≤ 9.0.0
Cloud5 products
- jasperreports_io≤ 4.0.0
- jasperreports_library≤ 7.0.3 | ≤ 9.0.2
- jasperreports_server≤ 9.0.0
- jasperreports_studio≤ 7.0.3 | ≤ 9.0.2
- jasperreports_web_studio≤ 3.0.1
Net.sf.jasperreports1 product
- jasperreports< 7.0.4
Ubuntu1 product
- jasperreportsAll versions (No fix recorded)
4 vendors · 15 products
References
10 links- community.jaspersoft.com/advisories/…Vendor Advisory
