Oracle Java SE EUVD-2026-106298

Exploitation requires the vulnerable JAAS APIs to be reachable, specifically an application or service that supplies attacker-controlled data to those APIs (e.g., a web service front-ending JAAS functionality) - this is the server-side vector Oracle calls out. A second, more limited vector applies to Java deployments that run sandboxed Java Web Start applications or sandboxed applets loading untrusted code from the internet and relying on the Java sandbox; this path is largely legacy since browser applet/Web Start support is deprecated and uncommon in modern deployments. LIMITING FACTORS: impact is restricted to partial read-only data disclosure (no data modification or DoS); the client-side vector depends on a victim running untrusted sandboxed code; only the specific affected versions are impacted (Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; GraalVM for JDK 17.0.20.1/21.0.12.1; GraalVM EE 21.3.19.1.1).

This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) in the JAAS component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction, but impact is confined to unauthorized read access to a SUBSET of accessible data (C:L) with no integrity or availability impact. Oracle rates it 'easily exploitable,' which aligns with AC:L/PR:N. However, the real-world priority is tempered by the limited confidentiality-only impact and the exploitation surface: the description points to two distinct vectors - a server-side path via APIs/web services and a client-side path affecting sandboxed Java Web Start applications and applets running untrusted code - the latter being largely legacy/deprecated technology rarely deployed today. No EPSS score, KEV listing, or POC was provided in the input; absence of these is not confirmation of safety, but there is no signal of active exploitation or public exploit code at this time. Net: treat as a routine-to-moderate patch priority (part of the Oracle October 2026 CPU) rather than an emergency, given the partial-read impact and lack of exploitation evidence. CONFLICT TO NOTE: the input Tags label this 'Authentication Bypass,' but the CVSS and description describe a confidentiality-only information disclosure (C:L/I:N/A:N), not a bypass of authentication - verify tag accuracy.

An unauthenticated attacker sends specially crafted data over the network to an application that exposes the vulnerable JAAS APIs - for example, through a web service that passes attacker-supplied input to those APIs - and gains unauthorized read access to a subset of data accessible to the Java runtime. Alternatively, in legacy setups, a victim runs a malicious sandboxed Java Web Start app or applet that loads untrusted code and leverages the flaw. No public exploit code was identified in the provided data, and attack complexity is low.