This vulnerability exists in the Security component of Oracle Java SE. It allows an unauthenticated attacker with network access through multiple protocols to perform unauthorized updates, inserts, or deletes on data accessible through the Java SE APIs. The weakness is an improper access control flaw, enabling the attacker to bypass standard authorization checks. The impact is a compromise of data integrity, as the attacker can alter or delete existing information without permission. This flaw is identified as CWE-354 and CWE-502.

Affected vendor is Oracle; product is Oracle Java SE. The vulnerable releases are Java SE 21.0.12.1, Java SE 25.0.4.1, and Java SE 27. Each of these versions contains the unpatched Security component that permits the exploit. The issue also extends to deployments that use sandboxed Java Web Start applications or applets loading untrusted code, which rely on the Java sandbox for security.

The CVSS v3.1 base score is 3.7 (low to moderate), indicating that while the direct exploitation effort is high and the confidentiality impact is nominal, the integrity impact is significant. The EPSS score is < 1%, showing a very low but nonzero likelihood of exploitation. There is no current evidence of exploits in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access through exposed APIs, requiring no authentication. Due to the vulnerability’s nature, it is best suited for scenarios where the attacker can interact with the Java SE service or supply input to APIs that process untrusted data.