Looking to get some information if possible on a detected vulnerability in our Unimus software. We're running 2.7.0 on an Azure virtual server, and our vulnerability scanner is reporting a vulnerability involving the embedded Java instance in the software.
The specific finding is: Unspecified vulnerability in Oracle Java SE, Azul Zulu and Amazon Corretto via vectors related to 2D - CVE-2025-30749
The files it's triggering on are:
C:\Program Files\Unimus\jre17\bin\java.exe
C:\Program Files\Unimus\jre17\bin\javaw.exe
Both versions are 17.0.15.0, and this version apparently is subject to the CVE listed above. Anything we can do to clear the vulnerability?
[Solved] Oracle Java vulnerability in 2.7.0
Hello.
The description and details for this CVE are very vague. From all the research and details we were able to find, this vulnerability only applies and can only be triggered if untrusted bytecode can be submitted and executed by the JRE.
For Unimus, this is not the case, as Unimus doesn't allow external Java code to be executed through it at all. So this vulnerability and CVE is NOT applicable to Unimus, and Unimus is not affected.
In addition, we will update to the latest (at the time of writing, 17.0.16+8) embedded JRE for Windows with the 2.7.1 release, just so this doesn't pop up in reports.
The description and details for this CVE are very vague. From all the research and details we were able to find, this vulnerability only applies and can only be triggered if untrusted bytecode can be submitted and executed by the JRE.
For Unimus, this is not the case, as Unimus doesn't allow external Java code to be executed through it at all. So this vulnerability and CVE is NOT applicable to Unimus, and Unimus is not affected.
In addition, we will update to the latest (at the time of writing, 17.0.16+8) embedded JRE for Windows with the 2.7.1 release, just so this doesn't pop up in reports.