What is the CVSS score of CVE-2026-47010?

CVE-2026-47010 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-47010?

Yes, a patch is available for CVE-2026-47010. Update the affected software to the latest version immediately.

Oracle Java SE CVE-2026-47010

EUVD-2026-46499 LOW

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-fhjm-g79r-vv57

Authentication Bypass Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation

3.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.7 LOW

Network-reachable via image APIs but AC:H reflects difficult exploitation conditions; no privileges required; integrity-only impact confirmed by description.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:39 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

LOW 3.7

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

AnalysisAI

Integrity compromise in Oracle Java SE's ImageIO component allows unauthenticated remote attackers to perform unauthorized data modification against a broad range of Java SE and GraalVM versions. Exploitation requires high attack complexity, limiting opportunistic mass exploitation, but the scope spans ten distinct supported releases across Java SE 8 through 26 and both GraalVM product lines. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the low CVSS score of 3.7 belies a moderately wide attack surface given Java's deployment footprint.

Technical ContextAI

The affected component is ImageIO, Java's built-in image reading and writing framework (javax.imageio). ImageIO supports multiple image formats (PNG, JPEG, TIFF, GIF, BMP, WBMP) and is consumed broadly by web services, application servers, and graphical applications. The vulnerability is reachable through Java API calls to ImageIO - meaning any web service or application that processes user-supplied image data via these APIs is an exposure point. Additionally, the description explicitly flags sandboxed Java Web Start applications and Java applets that execute untrusted code as a second attack surface, indicating the flaw may allow partial sandbox escape affecting data integrity. The CWE is listed as N/A, but the 'Authentication Bypass' tag in the intelligence feed suggests the flaw may undermine a sandbox or access-control boundary within the Java runtime rather than a classic memory-safety issue. CPE data confirms three product lines are affected: oracle_java_se, oracle_graalvm_for_jdk, and oracle_graalvm_enterprise_edition.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html, which addresses this vulnerability across all listed affected versions. Oracle does not publish exact patched version numbers separately from the CPU document - consult the CPU to confirm the exact updated build for each affected release. For environments that cannot immediately patch, restrict or disable processing of externally supplied image data through Java ImageIO APIs. Web services that accept user-uploaded images should implement upstream format validation and file type filtering before images reach the ImageIO layer, reducing exposure to crafted inputs. Java Web Start is end-of-life in modern JDK versions (removed in JDK 11+); organizations still running sandboxed Web Start or applet environments should prioritize migration as a compensating control. Disabling the Java Plugin in browsers (already unsupported in most modern browsers) removes the applet attack surface entirely. Note that restricting network access to services using ImageIO provides partial mitigation but may not eliminate risk where internal users can supply untrusted image content.