Unimus forum

Looking to get some information if possible on a detected vulnerability in our Unimus software. We're running 2.7.0 on an Azure virtual server, and our vulnerability scanner is reporting a vulnerability involving the embedded Java instance in the software.

The specific finding is: Unspecified vulnerability in Oracle Java SE, Azul Zulu and Amazon Corretto via vectors related to 2D - CVE-2025-30749

The files it's triggering on are:
C:\Program Files\Unimus\jre17\bin\java.exe
C:\Program Files\Unimus\jre17\bin\javaw.exe

Both versions are 17.0.15.0, and this version apparently is subject to the CVE listed above. Anything we can do to clear the vulnerability?

Hello.

The description and details for this CVE are very vague. From all the research and details we were able to find, this vulnerability only applies and can only be triggered if untrusted bytecode can be submitted and executed by the JRE.

For Unimus, this is not the case, as Unimus doesn't allow external Java code to be executed through it at all. So this vulnerability and CVE is NOT applicable to Unimus, and Unimus is not affected.

In addition, we will update to the latest (at the time of writing, 17.0.16+8) embedded JRE for Windows with the 2.7.1 release, just so this doesn't pop up in reports.

When will the 2.7.1 release be available?

We’re finishing the last few acceptance testing steps. Once those are completed, we’ll release version 2.7.1. If nothing unexpected occurs, it should be out by the end of the week.

Awesome, thanks so much for the assistance and info!