CVE-2023-21954

CVE-2023-21954 is a difficult-to-exploit vulnerability in Oracle Java SE (versions 8u361, 11.0.18, 17.0.6) and Oracle GraalVM Enterprise Edition (versions 20.3.9, 21.3.5, 22.3.1) affecting the Hotspot component. An unauthenticated attacker with network access can compromise these products, leading to unauthorized access to critical or all accessible data. The vulnerability primarily impacts Java deployments running sandboxed applications that load untrusted code, or can be exploited via APIs. Rated with a CVSS 3.1 Base Score of 5.9 (Medium), this vulnerability has a network attack vector and high attack complexity, but no user interaction is required. Successful exploitation results in high confidentiality impact, with no integrity or availability impact. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public attention.