This vulnerability exists in the Install component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is easily exploitable by an attacker with low privileges who has logon access to the system where these products run. The CVSS 3.1 base score is 7.8, with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Affected versions include Oracle Java SE 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK 17.0.19 and 21.0.11; and Oracle GraalVM Enterprise Edition 21.3.18. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for these versions.

The vulnerability allows an attacker with low privileges and logon access to fully compromise Oracle Java SE and GraalVM environments, impacting confidentiality, integrity, and availability. This could lead to complete takeover of the affected software components, potentially enabling unauthorized access, data manipulation, and service disruption.

Oracle's Critical Patch Update advisory for July 2026 recommends that customers apply security patches without delay and remain on actively supported versions. However, the advisory does not explicitly confirm the availability of a patch or official fix for this specific vulnerability. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance. Until a patch is confirmed, restrict logon access to affected systems to trusted users only.