This vulnerability affects Oracle Java SE (versions 8u471, 11.0.29, 17.0.17, 21.0.9, 25.0.1), Oracle GraalVM for JDK (17.0.17, 21.0.9), and Oracle GraalVM Enterprise Edition (21.3.16). It resides in the Networking component and allows an unauthenticated attacker with network access to exploit it via multiple protocols, requiring user interaction from a third party. Successful exploitation can result in unauthorized modification (update, insert, delete) and unauthorized read access to some data accessible by these products. The vulnerability can be exploited through APIs, including web services and sandboxed Java Web Start applications or applets that load untrusted code. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. Oracle's January 2026 Critical Patch Update includes patches addressing this vulnerability.

Successful exploitation allows unauthorized update, insertion, deletion, and reading of some data accessible by Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This compromises confidentiality and integrity of data within the affected products. The attack requires network access and user interaction from a third party, and the scope of impact may extend beyond the initially affected products. There is no impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released security patches for this vulnerability as part of the January 2026 Critical Patch Update. Customers should apply these patches promptly to mitigate the risk. Oracle strongly recommends running actively supported versions and applying Critical Patch Updates without delay. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cpujan2026.html.