What’s Vulnerable › Vulnerabilities

CVE-2025-10492: Jaspersoft Library Deserialisation Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-16 · updated 2026-06-17
• Weakness: CWE-502

Description

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

Affected products

• Cloud Jasperreports Io: through 4.0.0
• Cloud Jasperreports Library: through 7.0.3; through 9.0.2
• Jaspersoft JasperReports Server: through 9.0.0
• Cloud Jasperreports Studio: through 7.0.3; through 9.0.2
• Jaspersoft JasperReports Web Studio: through 3.0.1

References

• https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/
• https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition

Get alerted when CVE-2025-10492 or the next vulnerability affects your stack