Vulnerability CVE-2025-50059 reported on Autosys System Agent rt.jar

Products

• Workload Automation Agent

Issue/Introduction

A vulnerability scan reports CVE-2025-50059 for the rt.jar file located in the jre/lib directory of the Autosys System Agent (version 24.0 or similar).

Scanning tools may flag this as a high or medium risk due to the presence of classes that could be exploited in sandboxed Java environments.

Environment

• Product: Autosys Workload Automation System Agent
• Version: 24.x, 12.x
• Platform: All supported platforms (Linux, Windows, etc.) using bundled JRE 1.8, Java 11, Java 17, Java 21

Cause

CVE-2025-50059 is a vulnerability that impacts Java client applications running untrusted code (such as sandboxed web applets) from the internet.

The Autosys System Agent is a server-side component that executes only trusted, scheduled enterprise workloads. It does not run in a sandbox and does not execute untrusted code. Therefore, while the scanner flags the presence of the code in the JRE library, the agent is not exploitable by this vulnerability.

Resolution

There are two approaches to address this finding:

Option 1: Security Exception (Recommended)

Provide the risk assessment to your InfoSec team to mark this finding as a false positive. Since the agent is a server-side process that does not run untrusted code, it does not meet the criteria for exploitation.

Option 2: Update the JRE

If your security policy requires a clean scan regardless of exploitability, you can upgrade the agent's JRE to a version that includes the fix (Java 8 Update 452 or later).

1. Download the latest supported version (OpenJDK or Oracle) for your platform.
2. Stop the System Agent service.
3. Follow the steps in the documentation to redirect the agent to the new JRE: Replace the JRE Installed by the Agent Without Upgrading the Agent.
4. Restart the System Agent and verify connectivity to the scheduler.