CVE-2025-10492 is a critical Java deserialization flaw (CVSS 9.8) in Jaspersoft Library that may allow remote code execution. The record lists no fixed version. Read the Jaspersoft advisory of 16 September 2025, apply what it names, and scan your Java dependencies.
What's affected
The record lists several Jaspersoft products as affected: JasperReports Library, JasperReports Server, JasperReports IO, Jaspersoft Studio and Jaspersoft Web Studio. The flaw is described as being in the Jaspersoft Library, so anything that bundles it is in scope.
The record does not state affected or fixed version numbers. A community forum thread referenced by the record is titled as a report of no fix being available after a JasperReports community edition upgrade. I could not read either page, so treat the vendor advisory as the only authority on fixed builds.
How to check if you're exposed
For Maven and Gradle projects, list the resolved Jaspersoft artifacts and their versions:
mvn dependency:tree | grep -i jasperreports
gradle dependencies | grep -i jasperreports
For a deployed JasperReports Server, find the version in the server administration pages and search the application lib folder for jasperreports jar files. Compare what you find against the vendor advisory.
Remember transitive use. A BI tool, an ERP add-on or an internal reporting service may bundle the library without listing it in your own manifest. A software bill of materials catches those, and the free scan at gold.safeguard.sh/scan is a quick start.
What to do now
- Read the Jaspersoft advisory of 16 September 2025 and note the fixed or mitigated builds it names.
- Inventory every application that bundles JasperReports components, including reporting add-ons.
- Upgrade as the advisory directs, then re-run your dependency scan to confirm the old version is gone.
- Restrict network access to report servers to the users and systems that need it.
- Run report servers with a least privilege service account, so a code execution bug has less to work with.
Why it matters
This is CWE-502, deserialization of untrusted data. Java object deserialization can trigger code paths that the developer never meant to expose, when the input is attacker controlled. The record says improper handling of externally supplied data may allow remote code execution, and the score of 9.8 reflects no privileges and no user interaction.
Reporting servers often hold database credentials and sit close to sensitive data, so a code execution bug there has a wide blast radius. The record does not flag this CVE as a CISA Known Exploited Vulnerability, so there is no confirmation here that it is exploited in the wild.
Reachability analysis helps here. It checks whether your code actually calls the vulnerable path, so you can put the services that truly use it first. It does not replace patching.
Planning for software with no vendor fix
When no patched version is named, you have three options: fix it yourself, shield it, or retire it. Fixing it yourself works well for small PHP applications, since the change is usually one query. Shielding means network controls and a firewall rule. Retiring means moving to a maintained alternative.
Whichever you choose, write the decision down with an owner and a review date. Unpatched software tends to be forgotten rather than decided on. Continuous monitoring of your inventory against new advisories makes sure a fix, if one appears later, does not slip past you.
How scoring and records can mislead
A CVSS score is a starting point. It describes the flaw in general, not your deployment. Two things can move your real risk in either direction: whether the vulnerable component is reachable from where attackers sit, and what the process can touch once compromised.
Also keep in mind that records for newly published CVEs are often thin. Some state a vendor name and a file and little else. When the advisory is short, rely on your own inventory and on defensive basics, and revisit the record as details are added.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Where do I find the fixed version?
In the Jaspersoft security advisory of 16 September 2025. The record gives no version numbers, and I could not read the page.
How do I find indirect use of the library?
Generate a software bill of materials and search it for jasperreports. Direct manifests miss bundled copies.
Sources
- Safeguard Gold entry for CVE-2025-10492
- NVD record for the CVE, as supplied in the Safeguard CVE feed
- The links below come from that record. Several could not be opened when this post was reviewed, so confirm details with the vendor.
- https://community.jaspersoft.com/advisories/jaspersoft-security-advisory-september-16-2025-jaspersoft-library-cve-2025-10492-r6/
- https://community.jaspersoft.com/forums/topic/69926-cve-2025-10492-%E2%80%93-no-fix-available-after-jasperreports-upgrade-community-edition
Last reviewed: 19 October 2026.
