Oracle Java SE EUVD-2026-106138

Exploitation requires an application or service that supplies attacker-controlled data to the affected Oracle Java SE Compiler component APIs (per Oracle, reachable 'such as through a web service'); the runtime is not attackable in isolation. Oracle explicitly notes it can only be exploited by supplying data to the specified Component APIs WITHOUT using Untrusted Java Web Start applications or Untrusted Java applets. Limiting factors: only Oracle Java SE 26.0.2 is affected; HIGH attack complexity (AC:H) means reliable triggering is difficult; and the host application must actually expose the Compiler APIs to untrusted input. No authentication or user interaction is required (PR:N/UI:N).

This is a moderate-severity availability-only flaw that is NOT a top patching priority despite affecting a ubiquitous platform. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, base 5.9) shows a network-reachable, unauthenticated issue but with HIGH attack complexity, and impact limited strictly to availability (complete DoS via hang or repeatable crash) with no confidentiality or integrity loss. There is no CISA KEV listing and no public exploit identified, so this reflects no public exploit identified at time of analysis. No EPSS score was supplied in the input, so exploitation probability cannot be quantified; absence of KEV plus the stated 'difficult to exploit' nature from Oracle and the AC:H metric together argue against widespread opportunistic exploitation. No SSVC decision data was provided. The signals are internally consistent: Oracle's own 'Difficult to exploit' language aligns with AC:H, and the availability-only description aligns with C:N/I:N/A:H. The main real-world limiter is that exploitation requires feeding crafted data to the affected Compiler APIs through an application that exposes them (e.g., a web service), rather than the Java runtime being passively attackable.

An attacker identifies an internet-facing service that passes attacker-controlled input into the vulnerable Oracle Java SE Compiler component APIs (for example, a web service that compiles or processes submitted source/data). By crafting a malformed input that triggers the defect, the attacker causes the JVM to hang or repeatably crash, producing a complete denial of service. No public exploit code is known, and the high attack complexity means reliable triggering likely requires non-trivial crafting and specific application exposure.