A vulnerability in the Oracle Java SE Compiler component affects certain supported versions of Oracle Java SE and Oracle GraalVM for JDK. The flaw allows an unauthenticated attacker with network access via multiple protocols to potentially gain unauthorized read and write access to some data accessible by Oracle Java SE. The vulnerability can be exploited through APIs, including via web services supplying data to those APIs, and also affects sandboxed Java Web Start applications or applets running untrusted code. The CVSS 3.1 base score is 4.8, indicating a medium severity with impacts on confidentiality and integrity but no availability impact. Oracle has released a Critical Patch Update addressing this and other vulnerabilities and strongly recommends applying patches promptly.