A vulnerability exists in the Scripting component of Oracle Java SE and Oracle GraalVM Enterprise Edition affecting specific versions. It allows an unauthenticated attacker with network access to potentially create, delete, or modify critical data accessible by these products. The vulnerability can be exploited via APIs, including through web services that supply data to these APIs, and also affects Java deployments running sandboxed Java Web Start applications or applets that load untrusted code. The CVSS 3.1 base score is 5.9, indicating a medium severity with integrity impact only. Oracle has released security patches as part of their July 2025 Critical Patch Update advisory.