This vulnerability affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in specific versions including 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1 among others. It allows an unauthenticated attacker with network access to exploit the Security component via multiple protocols, potentially resulting in unauthorized update, insert, delete, and read access to some data accessible through these products. The vulnerability can be exploited through APIs, such as web services supplying data to these APIs, and also applies to Java deployments running sandboxed untrusted code relying on the Java sandbox for security. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and impacts on confidentiality and integrity but not availability. The vendor advisory does not explicitly confirm patch availability for this specific vulnerability but references a Critical Patch Update containing numerous patches and strongly recommends applying patches promptly.

Successful exploitation can lead to unauthorized read and write (update, insert, delete) access to some data accessible via Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This compromises confidentiality and integrity of affected data but does not impact availability. The vulnerability is exploitable remotely without authentication and does not require user interaction, increasing its risk profile. However, no known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Oracle’s Critical Patch Update advisory for July 2026 recommends applying security patches promptly to mitigate vulnerabilities including this one. Customers should ensure they are running actively supported versions and apply Oracle Critical Patch Updates without delay. No vendor advisory content indicates that no action is required or that the vulnerability is already mitigated without patching.