An unauthenticated attacker with network access can exploit a CORBA component vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition. By supplying crafted data to the exposed APIs over multiple protocols, the attacker can induce a partial denial of service, interrupting the availability of the affected services. The flaw does not require use of untrusted Java Web Start applications or applets, and can be triggered via standard web service interactions.

Oracle Java SE versions 8u503 and 8u503‑perf, and Oracle GraalVM Enterprise Edition 21.3.19.1.1 are impacted. These versions expose a CORBA interface that, when attacked, can be driven into an unusable state. Only the specified versions are known to be affected; later releases or alternative packages are not listed as vulnerable.

The CVSS score of 5.3 reflects a moderate availability impact, and the EPSS score of 0.00306 indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV inventory, but it can be leveraged over the network without authentication, so the risk is limited to availability. The attack requires only normal access to the service endpoints and can be performed as a simple network interaction. Because the flaw is limited to the CORBA component, it does not provide escalation for further exploitation.