This vulnerability resides in the JAXP component of Oracle Java SE and GraalVM products. It permits an unauthenticated attacker with network access to exploit the APIs exposed over various protocols, such as web services, to gain unauthorized access to critical data. The primary impact is confidentiality compromise, as the attacker can read sensitive data stored within the affected applications or the underlying systems.

The affected products are Oracle Java SE across multiple release streams (8u481, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26, 8u481-b50, 8u481-perf) and Oracle GraalVM distributions (GraalVM for JDK 17.0.18 and 21.0.10, and GraalVM Enterprise Edition 21.3.17). These versions are listed in the CVE advisory and correspond to the CPE strings provided.

The CVSS 3.1 base score of 7.5 reflects a high risk to confidentiality, with an attack vector of network and no authentication required. Although the EPSS score is not available and the vulnerability is not currently in the CISA KEV catalog, the combination of network reachability and lack of authentication makes exploitation highly feasible. An attacker can construct crafted XML payloads or use other XML-oriented protocols to trigger the JAXP component, potentially exposing sensitive data.