CVE-2025-10492: exploitation status and patch state

CVE-2025-10492 · CVSS 9.8 CRITICAL · EPSS 1%

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library

Is CVE-2025-10492 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 1%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2025-10492

• Java Deserialization RCE in Hitachi Energy Ellipse Reporting Component (2026-04-03)

Primary sources

• NVD record

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.