A flaw in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows a local attacker with access to the infrastructure where the software runs to read data that should be protected. The vulnerability resides in the handling of certain APIs, such as those that return data via a web service. When successfully exploited, an attacker can obtain unauthorized read access to a subset of data exposed by the affected component. The CVSS 3.1 Base Score of 2.9 reflects a low‑level confidentiality impact rather than full code execution or denial of service.

Affected versions include Oracle Java SE 8u481 (including the 8u481‑b50 and 8u481‑perf builds), 11.0.30, 17.0.18, 21.0.10, 25.0.2, and 26; Oracle GraalVM for JDK 17.0.18 and 21.0.10; and Oracle GraalVM Enterprise Edition 21.3.17. These products are listed in Oracle’s April 2026 Critical Patch Update.

The CVSS vector (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates that the attack requires local presence or access to the environment where the software is executed, and the exploit is considered difficult to employ. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation remains uncertain. Nevertheless, the potential for data exposure warrants timely remediation through the vendor’s update, particularly for systems handling sensitive information.