A vulnerability in the Remote Method Invocation component of Oracle Java SE allows an unauthenticated attacker who can reach the affected machine over the network to send crafted data to the RMI API. The flaw enables the attacker to perform unauthorized insert, update, delete and read operations against data that the Java application exposes. Confidentiality and integrity effects are considered low across the board, as the attacker gains limited control, but the impact is still significant for sensitive or privileged data.

Oracle Java SE 8u503 and 8u503-perf are affected; the same vulnerability also applies to Oracle GraalVM Enterprise Edition 21.3.19.1.1. Any installations running these versions and with RMI enabled on a network‑reachable port are susceptible.

The CVSS v3.1 base score of 5.4 indicates moderate severity, with no availability impact. The EPSS score is <1% and the vulnerability is not listed in CISA’s KEV catalog, which reduces the immediate threat perception, yet the lack of authentication and the ability to influence RMI calls raise concern. Exploitation requires network access and the ability to send data to the RMI service; it does not rely on WebStart applications or applets, meaning the attack surface is broader. Given the moderate score and network‑based attack vector, the risk remains non‑negligible for exposed systems.