Oracle Java SE EUVD-2026-106703

Exploitation requires that the target actually uses the JDK's Lightweight HTTP Server (com.sun.net.httpserver / jdk.httpserver module) to expose a reachable network service, and that the attacker can supply data directly to that component's APIs - for example through a web service - rather than via Untrusted Java Web Start applications or Untrusted Java applets, which Oracle explicitly excludes as the exploitation path. No authentication is required (PR:N) and no user interaction is needed (UI:N), and default-configured, network-reachable instances of the HTTP server are exploitable. The principal limiting factor is deployment: the vulnerable server component is an opt-in JDK feature, so Java installations that do not expose a service built on it are not reachable; impact is also inherently limited to partial integrity (no read access to confidential data and no denial of service).

This is a moderate-severity, integrity-only issue (CVSS 3.1 base 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) in the Lightweight HTTP Server component of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition, published in Oracle's October 2026 Critical Patch Update. The network vector, low attack complexity, and no-privilege/no-interaction requirement mean it is trivially reachable, but the impact ceiling is deliberately narrow: no confidentiality loss, no availability loss, and only LOW, partial unauthorized modify/insert/delete access to 'some' accessible data (C:N/I:L/A:N). No EPSS score, CISA KEV listing, or public POC is present in the supplied data. Signals are therefore consistent rather than conflicting - an easily exploitable but low-impact flaw - and should be treated as a routine patch-cycle item, NOT an emergency. The practical risk is bounded by actual exposure: the vulnerable component (the built-in com.sun.net.httpserver / jdk.httpserver stack) must be deliberately used to expose a web service, which most Java deployments do not do, so real-world attack surface is far smaller than the AV:N vector alone suggests. The input 'Authentication Bypass' tag is not supported by the description, which describes unauthorized data modification, not a bypass of authentication - treat that tag as unreliable context, not confirmed fact.

An organization exposes a service built on the JDK's Lightweight HTTP Server to the network. An unauthenticated remote attacker sends crafted data to the server's APIs over a supported protocol (e.g., via a web service request), triggering partial unauthorized modification, insertion, or deletion of some accessible data. No public exploit code is identified in the provided data, and the complexity is low, so exploitation would not require specialized conditions beyond reaching the exposed endpoint.