CVE-2025-10492: high-severity vulnerability in Jaspersoft JasperReports IO At-Scale
Jaspersoft Library Deserialisation Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.9%
A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Jaspersoft · JasperReports IO At-ScaleJaspersoft · JasperReports IO ProfessionalJaspersoft · JasperReports Library Community EditionJaspersoft · JasperReports Library ProfessionalJaspersoft · JasperReports ServerJaspersoft · JasperReports Web StudioJaspersoft · Jaspersoft Studio Community EditionJaspersoft · Jaspersoft Studio ProfessionalRelated CVEs — Jaspersoft JasperReports IO At-Scale
In the same product, most dangerous first.