The vulnerability resides in the 2D component of Oracle Java SE and Oracle GraalVM Enterprise Edition, allowing an unauthenticated attacker with network access to perform unauthorized updates, inserts or deletes on data accessible through those products. The impact is limited to integrity, enabling the attacker to modify data but not to execute arbitrary code or gain complete system control. The weakness involves improper access control where APIs exposed by the component fail to enforce adequate authorization checks, leading to potential integrity compromise.

Oracle products affected are Oracle Java SE 8u503 and 8u503-perf, and Oracle GraalVM Enterprise Edition 21.3.19.1.1. Users running these versions, especially in environments that rely on the Java sandbox for security such as Java Web Start applications, or sandboxed applets that load untrusted code, are at risk.

This CVSS 3.1 Base Score of 3.7 indicates a low severity vulnerability focusing solely on integrity. The EPSS score of < 1% indicates a very low exploitation probability. As the vulnerability is not listed in the CISA KEV catalog, it is not currently known to have been actively exploited in the wild. Attackers can achieve exploitation by leveraging exposed APIs over the network, typically through a web service that supplies data to those APIs. Based on the description, the likely attack vector is network access via multiple protocols. The risk to systems that expose the affected component is considered low but actionable due to the low severity score and very low exploitation probability.