This vulnerability affects multiple versions of Oracle Java SE (including 8u471, 11.0.29, 17.0.17, 21.0.9, and 25.0.1), Oracle GraalVM for JDK (17.0.17 and 21.0.9), and Oracle GraalVM Enterprise Edition (21.3.16). It resides in the RMI component and can be exploited by unauthenticated attackers with network access via multiple protocols. Successful exploitation can lead to unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The vulnerability can be triggered through APIs, such as web services supplying data to these APIs, and also affects Java deployments running sandboxed untrusted code. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity at a low level. Oracle has addressed this vulnerability in its January 2026 Critical Patch Update.

An attacker with network access and no authentication can exploit this vulnerability to perform unauthorized read and write operations on certain accessible data within affected Oracle Java SE and GraalVM products. This could lead to partial compromise of data confidentiality and integrity. There is no impact on availability. The vulnerability affects multiple widely used versions, increasing potential exposure if patches are not applied.

Oracle has released patches for this vulnerability as part of the January 2026 Critical Patch Update. Customers should apply these security patches without delay to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and promptly installing Critical Patch Updates to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.