This vulnerability affects Oracle Java SE (versions 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2), Oracle GraalVM for JDK (17.0.20, 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19). It resides in the Networking component and allows an unauthenticated attacker with network access via HTTP to compromise these products. Exploitation can lead to unauthorized access to critical or all accessible data. The vulnerability can be triggered via APIs, including web services and sandboxed Java applications that load untrusted code. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, scope change, high confidentiality impact, and no integrity or availability impact. Oracle’s advisory recommends applying security patches promptly and staying on actively supported versions. No known exploits in the wild have been reported.

Successful exploitation can result in unauthorized access to critical or all accessible data within Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The vulnerability affects confidentiality but does not impact integrity or availability. The scope change means that other products relying on these components may also be impacted. The vulnerability is difficult to exploit and requires network access via HTTP.

Oracle strongly recommends that customers remain on actively supported versions and apply available security patches without delay. This vulnerability is addressed in Oracle’s August 2026 Critical Security Patch Update. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. No additional mitigation steps are specified beyond patching. There are no reports of known exploits in the wild at this time.