A flaw in the compiler component of Oracle Java SE enables an unauthenticated attacker who can reach the affected APIs over a network to submit crafted data. Processing this data allows the attacker to perform unauthorized insert, update, or delete operations on data exposed by the Java SE instance, and to read a limited subset of that data. The vulnerability does not enable arbitrary code execution; instead it compromises confidentiality and integrity by allowing data modification and leakage.

Oracle Java SE versions 21.0.12.1, 25.0.4.1, and 27 are affected. The issue resides in the compiler component and requires the attacker to send data to specific remote APIs, for example via a web service. Any deployment that exposes these compiler APIs to the network is potentially vulnerable.

The CVSS v3.1 base score of 4.8 indicates moderate severity with low confidentiality and integrity impacts. The EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires network access, no authentication, but is difficult because it depends on specific compiler API endpoints. Overall, the risk is moderate; organizations should verify whether the affected APIs are reachable from outside their trusted perimeter and apply available mitigations.