Skip to main content

Oracle Java SE CVE-2026-47027

| EUVDEUVD-2026-46514 MEDIUM
Improper Access Control (CWE-284)
2026-07-21 oracle GHSA-cqfh-fjhw-mr88
Authentication Bypass Denial Of Service Java Oracle Oracle Java Se Oracle Corporation
5.3
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
5.3 MEDIUM

Network-accessible attack requiring no authentication or interaction; impact strictly limited to partial availability with no confidentiality or integrity effects, matching Oracle's disclosed scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 02:42 vuln.today
CVE Published
Jul 21, 2026 - 21:33 nvd
MEDIUM 5.3

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.

Technical ContextAI

The affected component is the Libraries subsystem of the Java SE runtime, a foundational layer that underpins core data structures, utility classes, and standard APIs used by virtually all Java applications. The CPE string cpe:2.3:a:oracle_corporation:oracle_java_se:*:*:*:*:*:*:*:* reflects the broad product scope. Affected runtimes span Oracle Java SE versions 8u491 through 26.0.1, Oracle GraalVM for JDK 17.0.19 and 21.0.11 (which share the HotSpot JDK codebase), and Oracle GraalVM Enterprise Edition 21.3.18. The vulnerability affects multiple long-term support (LTS) releases simultaneously (Java 8, 11, 17, 21) as well as the current non-LTS streams (Java 25, 26), indicating a defect in shared library code rather than a version-specific regression. No CWE identifier was assigned by Oracle, so the root-cause class is not disclosed; the partial availability impact and multi-protocol attack surface are consistent with resource exhaustion, improper input handling, or algorithmic complexity weaknesses in library parsing or processing routines.

RemediationAI

Apply the patches released in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish specific fixed version numbers outside the CPU advisory matrix, so exact replacement versions should be confirmed against the July 2026 CPU release notes. Patch available per vendor advisory - independently confirmed fix versions should be retrieved from the Oracle CPU document before deployment. For environments where immediate patching is not feasible, compensating controls should include network-level restrictions that limit which systems can submit requests to Java service endpoints, particularly those exposing Libraries-component APIs over untrusted networks; restricting inbound protocol diversity (for example, filtering non-HTTP protocols at the perimeter) reduces the multi-protocol attack surface at the cost of legitimate protocol flexibility. For Java 8 deployments still using sandboxed Java Web Start applications, disabling or blocking JNLP execution at the endpoint level eliminates that specific attack path; note that this may break legacy desktop application delivery workflows.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected

Share

CVE-2026-47027 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy