CVE-2025-48734 Apache Commons BeanUtils
| Affected software | Apache Commons BeanUtils |
|---|---|
| Severity | 8.8 High CVSS 3.1 |
| Fixed in | 1.11.0 |
| Weakness | Improper access control (CWE-284) |
| Published | 28 May 2025 |
| Updated | 3 Nov 2026 |
Description
Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: poc CISA recorded that an exploit has been demonstrated. Automatable: no, technical impact: total.
- Indexed PoC 1 indexed, none at 5+ stars
- EPSS 2.0% chance in 30 days
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | CVE-2025-48734 - Affects Apache Commons BeanUtils in versions prior to 1.11.0 (and the 2.x branch before 2.0.0-M2). | 2026-03-20 |
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
A public code fix exists: apache/commons-beanutils bd20740.
- Protection none
- Action unverified
- Review automated Upstream data
- Record active
| Decided by | Exploit code for this candidate, published in a reviewed catalogue or a GitHub repository with 5 or more stars, or in use per CISA or VulnCheck; not only a CISA verdict, a forecast, or nothing at all |
|---|---|
| Finding | This CVE is not listed in CISA KEV or VulnCheck KEV, CISA Vulnrichment records no active exploitation, no reviewed exploit catalogue carries an entry for it, and no GitHub PoC repository for it has 5 or more stars. Nobody has published exploit code worth tracing, so it is not a candidate for a rule ahead of the ones where somebody has; an upstream fix path does exist, so the remediation half of the candidacy still holds. This is a statement about what has been published, not about whether the defect is reachable or serious. |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2026 ↗ | CPU | 2026-Q4 | Oracle Communications / Security (Apache Commons BeanUtils) (47.0.0.2.0) Oracle Enterprise Manager / Generic Virtualization (Apache Commons BeanUtils) (13.5) Oracle Enterprise Manager / Oracle Management Service (Apache Commons BeanUtils) (13.5, 24.1) |
| Oracle Critical Patch Update April 2026 ↗ | CPU | 2026-Q2 | Oracle Analytics / Platform Security (Apache Commons BeanUtils) (7.6.0.0.0, 8.2.0.0.0) Oracle Commerce / Experience Manager (Apache Commons BeanUtils) (11.4.0) Oracle E-Business Suite / Installation (Apache Commons BeanUtils) (12.2.4-12.2.15) Oracle E-Business Suite / Security (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle E-Business Suite / User Interface (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle E-Business Suite / User Interface (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle E-Business Suite / Web Service (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle E-Business Suite / iProcurement ECC shopping (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle Financial Services Applications / Base (Apache Commons BeanUtils) (14.5.0.0.0-14.8.0.0.0) Oracle Financial Services Applications / Configuration (Apache Commons BeanUtils) (14.6.0.0.0-14.8.0.0.0) Oracle Financial Services Applications / Logger (Apache Commons BeanUtils) (1.0.2.1) |
| Oracle Critical Patch Update January 2026 ↗ | CPU | 2026-Q1 | Oracle Communications / Configuration Management Platform (Apache Commons BeanUtils) (15.0.0.0) Oracle Construction and Engineering / Web Access (Apache Commons BeanUtils) (21.12.0.0-21.12.21.5, 22.12.0.0-22.12.20.0, 23.12.0.0-23.12.17.0, 24.12.0.0-24.12.6.0) Oracle E-Business Suite / Core (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle E-Business Suite / HTML Dispatch Center (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle E-Business Suite / Suitability Analyzer (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle E-Business Suite / iRecruitment (Apache Commons BeanUtils) (12.2.3-12.2.15) Oracle Financial Services Applications / Accessibility (Apache Commons BeanUtils) (14.5.0.15.0, 14.6.0.11.0, 14.7.0.9.0, 14.8.0.1.0, 14.8.1.0.0) Oracle Financial Services Applications / Common Core (Apache Commons BeanUtils) (14.5.0.15.0, 14.6.0.11.0, 14.7.0.9.0, 14.8.0.1.0, 14.8.1.0.0) Oracle Retail Applications / NF Issuing (Apache Commons BeanUtils) (14.2) Oracle Retail Applications / Operations and Maintenance (Apache Commons BeanUtils) (15.0.3, 16.0.3) Oracle Retail Applications / Security (Apache Commons BeanUtils) (15.0.3, 16.0.3) Oracle Supply Chain / Security (Apache Commons BeanUtils) (9.3.6) |
| Oracle Critical Patch Update October 2025 ↗ | CPU | 2025-Q4 | Oracle Communications / Configuration (Apache Commons BeanUtils) (25.1.200) Oracle Communications / Install (Apache Commons BeanUtils) (24.2.7-25.1.200) Oracle Communications Applications / Core (Apache Commons BeanUtils) (6.1.1) Oracle Fusion Middleware / ADF, ADF Faces (Apache Commons BeanUtils) (12.2.1.4.0) Oracle Hospitality Applications / Next-Gen SPMS (Apache Commons BeanUtils) (23.2.5) Oracle Hyperion / Installation and Configuration (Apache Commons BeanUtils) (11.2.22.0.000) Oracle Hyperion / Security (Apache Commons BeanUtils) (11.2.22.0.000) Oracle Hyperion / Security (Apache Commons BeanUtils) (11.2.22.0.000) Oracle Insurance Applications / EWPS (Apache Commons BeanUtils) (12.7.2.4, 13.0.0.3, 13.0.1.1) Oracle Insurance Applications / Third Party (Apache Commons BeanUtils) (11.3.1-12.0.5) Oracle JD Edwards / Portal Security (Apache Commons BeanUtils) (9.2.0.0-9.2.9.4) Oracle PeopleSoft / Portal (Apache Commons BeanUtils) (8.60, 8.61, 8.62) Oracle Retail Applications / Fusion Client (Apache Commons BeanUtils) (15.0.3, 16.0.3) Oracle Retail Applications / Security (Apache Commons BeanUtils) (15.0.3.1, 16.0.3) Oracle Retail Applications / Security (Apache Commons BeanUtils) (15.0.3.1, 16.0.3) Oracle Systems / Core (Apache Commons BeanUtils) (4) Oracle Utilities Applications / Security (Apache Commons BeanUtils) (4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 24.2.0.0.0, 24.3.0.0.0, 25.4, 25.10) |
| Oracle Critical Patch Update July 2025 ↗ | CPU | 2025-Q3 | Oracle Analytics / Core (Apache Commons BeanUtils) (7.6.0.0.0, 8.2.0.0.0) Oracle Communications / ATS Framework (Apache Commons BeanUtils) (24.2.0, 25.1.100) Oracle Communications / Platform (Apache Commons BeanUtils) (24.2.0) Oracle Communications / Signaling (Apache Commons BeanUtils) (24.3.1) Oracle Communications / Third Party (Apache Commons BeanUtils) (9.0.0-9.0.4) Oracle Communications Applications / Configuration (Apache Commons BeanUtils) (3.0.3.3.0, 3.0.3.4.0) Oracle Communications Applications / Infrastructure (Apache Commons BeanUtils) (6.3.1) Oracle Communications Applications / Security (Apache Commons BeanUtils) (7.4.0, 7.4.1, 7.5.0) Oracle Communications Applications / Third Party (Apache Commons BeanUtils) (12.0.0.4-12.0.0.8, 15.0.0.0, 15.0.1.0, 15.1.0.0) Oracle Communications Applications / Third Party (Apache Commons BeanUtils) (7.4.0-7.4.2, 7.5.0, 7.5.1, 7.6.0-7.8.0) Oracle Communications Applications / UI and Cartridges (Apache Commons BeanUtils) (7.3.6, 7.4.0, 7.5.0) Oracle Construction and Engineering / Platform (Apache Commons BeanUtils) (20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.14, 24.12.0-24.12.6) Oracle Enterprise Manager / Load Testing for Web Apps (Apache Commons BeanUtils) (13.3.0.1) Oracle Financial Services Applications / Installer (Apache Commons BeanUtils) (8.1.2.7) Oracle Financial Services Applications / Platform (Apache Commons BeanUtils) (8.0.7.8, 8.0.8.6, 8.1.1.4, 8.1.2.5) Oracle Financial Services Applications / Platform (Apache Commons BeanUtils) (8.0.8) Oracle Financial Services Applications / Platform (Apache Commons BeanUtils) (8.0.8.1, 8.1.2.8, 8.1.2.9) Oracle Fusion Middleware / Centralized Thirdparty Jars (Apache Commons BeanUtils) (12.2.1.4.0) Oracle Fusion Middleware / Console (Apache Commons BeanUtils) (12.2.1.4.0, 14.1.1.0.0) Oracle Fusion Middleware / Core (Apache Commons BeanUtils) (12.2.1.4.0) Oracle Fusion Middleware / Core (Apache Commons BeanUtils) (12.2.1.4.0) Oracle Fusion Middleware / Security Framework (Apache Commons BeanUtils) (12.2.1.4.0) Oracle Fusion Middleware / Third Party (Apache Commons BeanUtils) (12.2.1.4.0, 14.1.2.0.0) Oracle HealthCare Applications / Master Index Data Manager (Apache Commons BeanUtils) (5.0.0.0-5.0.9.2) Oracle Retail Applications / Installation (Apache Commons BeanUtils) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1) Oracle Retail Applications / Installation (Apache Commons BeanUtils) (14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1) Oracle Retail Applications / Point of Sale (Apache Commons BeanUtils) (20.0.5, 21.0.4, 22.0.2, 23.0.2, 24.0.1) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Analytics | Core (Apache Commons BeanUtils) | 7.6.0.0.0, 8.2.0.0.0 | 7.6.0.0.0 · 8.2.0.0.0 |
| Oracle Analytics | Platform Security (Apache Commons BeanUtils) | 7.6.0.0.0, 8.2.0.0.0 | 7.6.0.0.0 · 8.2.0.0.0 |
| Oracle Commerce | Experience Manager (Apache Commons BeanUtils) | 11.4.0 | 11.4.0 |
| Oracle Communications | ATS Framework (Apache Commons BeanUtils) | 24.2.0, 25.1.100 | 24.2.0 · 25.1.100 |
| Oracle Communications | Configuration (Apache Commons BeanUtils) | 25.1.200 | 25.1.200 |
| Oracle Communications | Configuration Management Platform (Apache Commons BeanUtils) | 15.0.0.0 | 15.0.0.0 |
| Oracle Communications | Install (Apache Commons BeanUtils) | 24.2.7-25.1.200 | |
| Oracle Communications | Platform (Apache Commons BeanUtils) | 24.2.0 | 24.2.0 |
| Oracle Communications | Security (Apache Commons BeanUtils) | 47.0.0.2.0 | 47.0.0.2.0 |
| Oracle Communications | Signaling (Apache Commons BeanUtils) | 24.3.1 | 24.3.1 |
| Oracle Communications | Third Party (Apache Commons BeanUtils) | 9.0.0-9.0.4 | |
| Oracle Communications Applications | Configuration (Apache Commons BeanUtils) | 3.0.3.3.0, 3.0.3.4.0 | 3.0.3.3.0 · 3.0.3.4.0 |
| Oracle Communications Applications | Core (Apache Commons BeanUtils) | 6.1.1 | 6.1.1 |
| Oracle Communications Applications | Infrastructure (Apache Commons BeanUtils) | 6.3.1 | 6.3.1 |
| Oracle Communications Applications | Security (Apache Commons BeanUtils) | 7.4.0, 7.4.1, 7.5.0 | 7.4.0 · 7.4.1 · 7.5.0 |
| Oracle Communications Applications | Third Party (Apache Commons BeanUtils) | 7.4.0-7.4.2, 7.5.0, 7.5.1, 7.6.0-7.8.0 | 7.5.0 · 7.5.1 · 15.0.0.0 · 15.0.1.0 · 15.1.0.0 |
| Oracle Communications Applications | UI and Cartridges (Apache Commons BeanUtils) | 7.3.6, 7.4.0, 7.5.0 | 7.3.6 · 7.4.0 · 7.5.0 |
| Oracle Construction and Engineering | Platform (Apache Commons BeanUtils) | 20.12.0-20.12.16, 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.14, 24.12.0-24.12.6 | |
| Oracle Construction and Engineering | Web Access (Apache Commons BeanUtils) | 21.12.0.0-21.12.21.5, 22.12.0.0-22.12.20.0, 23.12.0.0-23.12.17.0, 24.12.0.0-24.12.6.0 | |
| Oracle E-Business Suite | Core (Apache Commons BeanUtils) | 12.2.3-12.2.15 | |
| Oracle E-Business Suite | HTML Dispatch Center (Apache Commons BeanUtils) | 12.2.3-12.2.15 | |
| Oracle E-Business Suite | Installation (Apache Commons BeanUtils) | 12.2.4-12.2.15 | |
| Oracle E-Business Suite | Security (Apache Commons BeanUtils) | 12.2.3-12.2.15 | |
| Oracle E-Business Suite | Suitability Analyzer (Apache Commons BeanUtils) | 12.2.3-12.2.15 | |
| Oracle E-Business Suite | User Interface (Apache Commons BeanUtils) | 12.2.3-12.2.15 | |
| Oracle E-Business Suite | Web Service (Apache Commons BeanUtils) | 12.2.3-12.2.15 | |
| Oracle E-Business Suite | iProcurement ECC shopping (Apache Commons BeanUtils) | 12.2.3-12.2.15 | |
| Oracle E-Business Suite | iRecruitment (Apache Commons BeanUtils) | 12.2.3-12.2.15 | |
| Oracle Enterprise Manager | Generic Virtualization (Apache Commons BeanUtils) | 13.5 | 13.5 |
| Oracle Enterprise Manager | Load Testing for Web Apps (Apache Commons BeanUtils) | 13.3.0.1 | 13.3.0.1 |
| Oracle Enterprise Manager | Oracle Management Service (Apache Commons BeanUtils) | 13.5, 24.1 | 13.5 · 24.1 |
| Oracle Financial Services Applications | Accessibility (Apache Commons BeanUtils) | 14.5.0.15.0, 14.6.0.11.0, 14.7.0.9.0, 14.8.0.1.0, 14.8.1.0.0 | 14.5.0.15.0 · 14.6.0.11.0 · 14.7.0.9.0 · 14.8.0.1.0 · 14.8.1.0.0 |
| Oracle Financial Services Applications | Base (Apache Commons BeanUtils) | 14.5.0.0.0-14.8.0.0.0 | |
| Oracle Financial Services Applications | Common Core (Apache Commons BeanUtils) | 14.5.0.15.0, 14.6.0.11.0, 14.7.0.9.0, 14.8.0.1.0, 14.8.1.0.0 | 14.5.0.15.0 · 14.6.0.11.0 · 14.7.0.9.0 · 14.8.0.1.0 · 14.8.1.0.0 |
| Oracle Financial Services Applications | Configuration (Apache Commons BeanUtils) | 14.6.0.0.0-14.8.0.0.0 | |
| Oracle Financial Services Applications | Installer (Apache Commons BeanUtils) | 8.1.2.7 | 8.1.2.7 |
| Oracle Financial Services Applications | Logger (Apache Commons BeanUtils) | 1.0.2.1 | 1.0.2.1 |
| Oracle Financial Services Applications | Platform (Apache Commons BeanUtils) | 8.0.7.8, 8.0.8.6, 8.1.1.4, 8.1.2.5 | 8.0.7.8 · 8.0.8 · 8.0.8.1 · 8.0.8.6 · 8.1.1.4 · 8.1.2.5 · 8.1.2.8 · 8.1.2.9 |
| Oracle Fusion Middleware | ADF, ADF Faces (Apache Commons BeanUtils) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Centralized Thirdparty Jars (Apache Commons BeanUtils) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Console (Apache Commons BeanUtils) | 12.2.1.4.0, 14.1.1.0.0 | 12.2.1.4.0 · 14.1.1.0.0 |
| Oracle Fusion Middleware | Core (Apache Commons BeanUtils) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Security Framework (Apache Commons BeanUtils) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | Third Party (Apache Commons BeanUtils) | 12.2.1.4.0, 14.1.2.0.0 | 12.2.1.4.0 · 14.1.2.0.0 |
| Oracle HealthCare Applications | Master Index Data Manager (Apache Commons BeanUtils) | 5.0.0.0-5.0.9.2 | |
| Oracle Hospitality Applications | Next-Gen SPMS (Apache Commons BeanUtils) | 23.2.5 | 23.2.5 |
| Oracle Hyperion | Installation and Configuration (Apache Commons BeanUtils) | 11.2.22.0.000 | 11.2.22.0.0 |
| Oracle Hyperion | Security (Apache Commons BeanUtils) | 11.2.22.0.000 | 11.2.22.0.0 |
| Oracle Insurance Applications | EWPS (Apache Commons BeanUtils) | 12.7.2.4, 13.0.0.3, 13.0.1.1 | 12.7.2.4 · 13.0.0.3 · 13.0.1.1 |
| Oracle Insurance Applications | Third Party (Apache Commons BeanUtils) | 11.3.1-12.0.5 | |
| Oracle JD Edwards | Portal Security (Apache Commons BeanUtils) | 9.2.0.0-9.2.9.4 | |
| Oracle PeopleSoft | Portal (Apache Commons BeanUtils) | 8.60, 8.61, 8.62 | 8.60 · 8.61 · 8.62 |
| Oracle Retail Applications | Fusion Client (Apache Commons BeanUtils) | 15.0.3, 16.0.3 | 15.0.3 · 16.0.3 |
| Oracle Retail Applications | Installation (Apache Commons BeanUtils) | 14.1.3.2, 15.0.3.1, 16.0.3, 19.0.1 | 14.1.3.2 · 15.0.3.1 · 16.0.3 · 19.0.1 |
| Oracle Retail Applications | NF Issuing (Apache Commons BeanUtils) | 14.2 | 14.2 |
| Oracle Retail Applications | Operations and Maintenance (Apache Commons BeanUtils) | 15.0.3, 16.0.3 | 15.0.3 · 16.0.3 |
| Oracle Retail Applications | Point of Sale (Apache Commons BeanUtils) | 20.0.5, 21.0.4, 22.0.2, 23.0.2, 24.0.1 | 20.0.5 · 21.0.4 · 22.0.2 · 23.0.2 · 24.0.1 |
| Oracle Retail Applications | Security (Apache Commons BeanUtils) | 15.0.3, 16.0.3 | 15.0.3 · 15.0.3.1 · 16.0.3 |
| Oracle Supply Chain | Security (Apache Commons BeanUtils) | 9.3.6 | 9.3.6 |
| Oracle Systems | Core (Apache Commons BeanUtils) | 4 | 4 |
| Oracle Utilities Applications | Security (Apache Commons BeanUtils) | 4.3.0.5.0, 4.3.0.6.0, 4.4.0.0.0, 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 24.2.0.0.0, 24.3.0.0.0, 25.4, 25.10 | 4.3.0.5.0 · 4.3.0.6.0 · 4.4.0.0.0 · 4.4.0.2.0 · 4.4.0.3.0 · 4.4.0.4.0 · 4.5.0.0.0 · 4.5.0.1.1 · 4.5.0.1.3 · 4.5.0.2.0 · 24.2.0.0.0 · 24.3.0.0.0 · 25.4 · 25.10 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
commons-beanutils:commons-beanutils |
1.0 | 1.11.0 |
unbounded |
org.apache.commons:commons-beanutils2 |
2.0.0-M1 | 2.0.0-M2 |
unbounded |
Products and versions
3 products, 4 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | commons beanutils | generic | ≥ 1.0 and ＜ 1.11.0 · 2.0.0:milestone1 |
| osv | commons-beanutils | commons-beanutils | generic | ≥ 1.0 and ＜ 1.11.0 |
| osv | org.apache.commons | commons-beanutils2 | generic | ≥ 2.0.0 and ＜ 2.0.0 |
References
Timeline
Timeline
| Published | 2025-05-28 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-11-03 | NVD's own last-modified date for this record. |