The vulnerability enables an unauthenticated attacker with network access to supply data to networking APIs and obtain unauthorized update, insert or delete capabilities on Oracle Java SE and GraalVM products. Successful exploitation produces a loss of data integrity, allowing the attacker to modify or corrupt data that the product manages without requiring any credentials. The weakness permits malicious data manipulation and can be exploited by sending crafted requests to exposed API endpoints.

Oracle Corporation’s Java SE editions 8u503, 8u503‑perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27, as well as Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition 21.3.19.1.1 are affected.

The CVSS 3.1 base score of 5.3 indicates a moderate severity with an integrity impact. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability; the vulnerability is not listed in CISA KEV. The likely attack vector is network access via multiple protocols (e.g., web services), as the description specifies that the flaw can be exploited through API calls without using untrusted Java Web Start applications or applets. Successful exploitation requires only network connectivity to the vulnerable service and does not need privileged credentials.