A vulnerability in Oracle Java SE's JSSE component affects several supported versions including Oracle Java SE 8u451, 11.0.27, 17.0.15, 21.0.7, and 24.0.1, as well as Oracle GraalVM versions. The flaw allows a difficult-to-exploit attack by an unauthenticated network attacker via TLS, potentially leading to unauthorized read and write access to some accessible data. This vulnerability primarily impacts Java deployments running untrusted code in sandboxed environments such as Java Web Start applications or applets, and does not affect server deployments running only trusted code. The CVSS 3.1 base score is 4.8, indicating a medium severity level. Oracle has released patches as part of its July 2025 Critical Patch Update, and customers are strongly advised to apply these updates promptly.