Oracle Java SE EUVD-2026-106663

Exploitation requires that the target Java/GraalVM deployment expose the affected JGSS component (Java's GSS-API / Kerberos security services) to attacker-reachable input - Oracle states the flaw is reached through APIs in the JGSS component, e.g. a web service that supplies data to those APIs, or a sandboxed Java Web Start application or applet loading untrusted code. No authentication is required (PR:N) and no user interaction (UI:N), but the AC:H rating indicates meaningful limiting factors: successful attack likely depends on specific malformed-input, timing, or race conditions rather than a single deterministic request. Realistic risk is confined to systems that actually process untrusted data through JGSS/GSS-API paths; JVMs not exposing this component to external input are not practically reachable.

This is a moderate-severity (CVSS 3.1 6.5) issue that signals are consistent in framing as a lower-priority, hard-to-exploit flaw rather than an urgent threat. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H) shows network reach with no authentication or user interaction, but critically AC:H (high attack complexity), which Oracle reinforces by labeling it a 'Difficult to exploit vulnerability.' Impact is skewed toward availability (A:H, a complete and repeatable DOS/hang) with only limited integrity impact (I:L) and no confidentiality loss. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or exploit availability - this appears to be a routine Oracle Critical Patch Update item rather than a flaw under attack. Net assessment: patch on normal Oracle CPU cadence; the high complexity and availability-centric impact make it a lower real-world priority than the network/unauthenticated vector alone might suggest. Note: EPSS, KEV, and POC signals are all absent from the input and cannot be confirmed either way.

A remote, unauthenticated attacker repeatedly sends specially crafted data to a Java service exposing the affected JGSS (GSS-API/Kerberos) functionality - for example via a web service that forwards attacker-supplied input to the vulnerable APIs. Successfully triggering the condition hangs or repeatedly crashes the JVM (complete denial of service) and allows limited unauthorized modification of some accessible data. The high attack complexity (AC:H) means exploitation likely requires specific timing, race, or malformed-input conditions rather than a single trivial request; no public exploit code was identified at time of analysis.