This vulnerability resides in the Utility component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can use exposed APIs—such as those provided by web services—to perform unauthorized update, insert, or delete operations on data that the product makes available, and can also cause a partial denial of service. The flaw results in integrity and availability impacts, as reflected by the CVSS base score of 6.5 and the vector indicating no user interaction is required.

Affected products include Oracle Java SE 8u503 (and the 8u503‑perf variant), 11.0.32.1; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; and Oracle GraalVM Enterprise Edition 21.3.19.1.1. These versions are listed in the CPE entries for each vendor and are covered in the advisory.

The CVSS score of 6.5 places the flaw in the medium range, and the EPSS score is <1%. The low EPSS score indicates a low probability of exploitation. Because the exploit requires only network access to exposed APIs and no authentication or user interaction, it is considered easy to exploit. The vulnerability is not included in the CISA KEV catalog, but it remains a significant risk for installations that expose the vulnerable component, especially in environments that load untrusted code via Java Web Start or applets.