Oracle Java SE CVE-2026-47013

Exploitation requires the target to be running Oracle Java SE 8u491 with the JavaFX component present and accessible. Two distinct attack paths exist with different prerequisites: (1) Server-side path - the target must run a web service or application that passes externally supplied network data to JavaFX APIs; JavaFX must be on the classpath and the service must be network-reachable; no authentication or user interaction is required (PR:N, UI:N per CVSS vector). (2) Client-side path - the victim must be running a sandboxed Java Web Start application or Java applet that loads and executes untrusted code from the internet, a legacy configuration increasingly uncommon in modern environments. What limits exploitation: impact is constrained to partial availability disruption only (no confidentiality or integrity breach); the client-side path requires the target to use deprecated Java Web Start or browser applet deployment, which is rare in contemporary enterprise environments; no special attacker privileges are required, but the server-side path requires that JavaFX APIs be reachable over the network.

CVSS 3.1 score of 5.3 (Medium) accurately captures the bounded impact ceiling - partial availability disruption only, with C:N and I:N confirming no data exposure or integrity violation. The CVSS vector (AV:N/AC:L/PR:N/UI:N) signals that exploitation requires no special conditions, no authentication, and no user interaction on the server-side path, making this theoretically trivially automatable against exposed services. However, the 'partial DOS' qualifier limits real-world consequence to service degradation rather than full compromise or data loss. No EPSS data was provided in the available intelligence, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation. The sandbox applicability note elevates client-side risk slightly, as Java Web Start and applet environments are legacy configurations that may not be actively monitored. Overall, this is a real but lower-priority issue: ease of exploitation is high, but the impact ceiling is low. Defenders should prioritize patching where Oracle Java SE 8 is externally exposed or runs in legacy applet/Web Start mode.

An unauthenticated remote attacker identifies a web service endpoint that internally invokes Oracle Java SE 8u491 JavaFX APIs and sends crafted, malformed data over a standard network protocol (HTTP, RMI, or similar), triggering a partial availability disruption that degrades or temporarily halts service. In the client-side path, a malicious website delivers untrusted code to a victim's sandboxed Java Web Start application or Java applet, exploiting the JavaFX component to cause partial denial-of-service within the sandboxed JVM. No public proof-of-concept exploit code has been identified at time of analysis.