This vulnerability exists in the Install component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure where these products run. Successful exploitation can lead to complete compromise of the affected Oracle Java SE and GraalVM products. The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Affected versions include Oracle Java SE 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK 17.0.19 and 21.0.11; and Oracle GraalVM Enterprise Edition 21.3.18. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among 1449 security patches released.

The vulnerability allows an attacker with low privileges and logon access to the affected system to fully compromise Oracle Java SE and GraalVM products. This includes complete loss of confidentiality, integrity, and availability of the affected software, potentially enabling full system takeover or unauthorized control of Java runtime environments.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability along with many others. Customers are strongly advised to apply the available patches promptly to affected versions. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is not explicitly stated for this CVE alone, but the vendor advisory is the authoritative source for patch availability and installation instructions.