Oracle Java SE EUVD-2026-106329

Exploitation requires that the affected Java SE Compiler component be reachable such that attacker-controlled data can be supplied to its APIs - explicitly WITHOUT using untrusted Java Web Start applications or untrusted Java applets, for example through a web service that passes attacker input into the component. Limiting factors: Oracle marks this high attack complexity (AC:H), so success depends on specific, non-trivial conditions rather than a simple single request; impact is confined to unauthorized read access to only a subset of accessible data (no write/integrity or availability impact). Deployments that do not expose the Compiler component to untrusted network input (e.g. no web service feeding external data into it) face substantially reduced realistic risk. No authentication is required (PR:N) and no user interaction is needed (UI:N).

This is a low-priority vulnerability by every available signal. The Oracle CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7 LOW) describes a network-reachable, unauthenticated flaw that is nonetheless HARD to exploit (AC:H) and yields only partial, read-only confidentiality impact (C:L) with no integrity or availability consequence. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed to be actively exploited. No EPSS score was provided in the input, so exploitation probability cannot be quantified here; absence of an EPSS value is a data gap, not a signal of low risk per se, but the high attack complexity and limited impact independently point to low real-world urgency. The combination of high-CVSS-but-low-real-risk does NOT apply - this is simply a low-CVSS, low-real-risk issue. One conflict worth flagging: the input Tags include 'Authentication Bypass,' which contradicts the description (unauthorized READ access to a subset of data, C:L only, no privilege or integrity impact) - this appears to be a mislabel and should not drive prioritization. Overall: routine patch during the normal Oracle Critical Patch Update cycle, not an emergency.

A remote, unauthenticated attacker repeatedly supplies specially crafted data to an exposed API backed by the affected Java SE Compiler component (for example via a web service), eventually triggering disclosure of a subset of data the Java runtime can access. Because the CVSS marks high attack complexity, the attacker likely needs specific conditions or many attempts to succeed, and no public exploit code is known at time of analysis.