Description
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthenticated remote data modification flaw in Oracle Java SE's Scripting component. An attacker with network access can invoke vulnerable APIs, including those exposed by web services supplying data, to write beyond array boundaries, enabling unauthorized creation, deletion or modification of critical data or complete access to all Java SE-accessible data. The flaw is identified as CWE-787, an out-of-bounds write condition, and also involves improper handling of serialized data designated as CWE-502. Successful exploitation results in confidentiality and integrity compromise, but availability is not affected.

Affected Systems

Affected products include Oracle Java SE 8u491, 8u491-perf and Java SE 11.0.31. The weakness can impact Java deployments such as sandboxed Java Web Start applications or Java applets that load untrusted code from the internet, relying on the Java sandbox for security.

Risk and Exploitability

The CVSS Base Score is 7.4 and the EPSS score is below 1%. The vulnerability is not listed in CISA KEV. Attackers likely target the exposed APIs over various protocols, requiring network access and no user interaction. Due to the out-of-bounds write, the flaw is considered difficult to exploit but remains a significant risk for organizations relying on the specified Java versions.

Generated by OpenCVE AI on August 2, 2026 at 23:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Java SE to a version that includes the vendor patch for CPUJul2026, such as any release newer than the identified affected versions.
  • If an upgrade is not immediately possible, restrict the use of the vulnerable scripting APIs by disabling them or removing them from exposed web services.
  • Enforce strict sandbox policies for Java Web Start applications and applets, ensuring only trusted code is loaded and that sandbox restrictions are not bypassed.
  • Apply input validation to all parameters passed to the vulnerable APIs and enforce safe deserialization practices to prevent out-of-bounds writes and disallow untrusted serialized data.

Generated by OpenCVE AI on August 2, 2026 at 23:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4702-1 openjdk-11 security update
History

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-502
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title openjdk: OpenJDK: Enhance Dataview Implementation (Oracle CPU 2026-07)
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle java Se
CPEs cpe:2.3:a:oracle:java_se:11.0.31:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u491:*:*:*:*:*:*:*
cpe:2.3:a:oracle:java_se:8u491:*:*:*:enterprise_performance:*:*:*
Vendors & Products Oracle
Oracle java Se
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Java Se Jdk Jre
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-01T03:56:47.473Z

Reserved: 2026-05-18T15:55:10.319Z

Link: CVE-2026-47058

cve-icon Vulnrichment

Updated: 2026-07-23T15:25:36.074Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-21T22:17:11.600

Modified: 2026-08-03T18:52:14.967

Link: CVE-2026-47058

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-21T20:00:00Z

Links: CVE-2026-47058 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T00:00:04Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data

  • CWE-787

    Out-of-bounds Write