Oracle JavaFX CVE-2026-47034

Exploitation requires the target to be running Oracle Java SE 8u491 in a client-side sandboxed context - specifically via Java Web Start or a sandboxed Java applet loading untrusted code from the network. Oracle explicitly states this vulnerability does NOT apply to server-side Java deployments running only administrator-installed trusted code. Beyond the sandboxed-client deployment prerequisite, successful exploitation further requires active user interaction (the user must trigger loading of the attacker-controlled Java content) and high attack complexity, meaning the attacker must satisfy specific technical preconditions beyond mere network reachability. The combination of client-only scope, mandatory user interaction, and high complexity substantially narrows the realistic exploitation window relative to what the network attack vector alone might suggest.

The CVSS 3.1 score of 3.1 (Low) accurately reflects a genuinely constrained threat profile. The vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N confirms network reachability but mandates high attack complexity and mandatory human interaction, preventing automated or mass exploitation. Impact is limited exclusively to integrity (I:L), with zero confidentiality or availability effect. No EPSS data was provided in source intelligence; however, given the low base score, client-only scope, user interaction requirement, and absence of both KEV listing and POC, real-world exploitation probability is assessed as very low. The most significant risk-reducing factor is that this vulnerability explicitly does not affect server-side Java deployments, which represent the dominant enterprise Java attack surface. Risk is practically relevant only to organizations still running Java Web Start or browser-based Java applets, an increasingly rare deployment pattern following broad browser plugin deprecation.

An attacker hosts a malicious web resource or Java Web Start application descriptor (.jnlp) containing crafted JavaFX content designed to trigger the sandbox flaw. A target user running Java SE 8u491 in a sandboxed client context visits the page or launches the application, satisfying the user-interaction requirement and providing the attacker an opportunity to exploit the high-complexity JavaFX vulnerability, resulting in limited unauthorized modification of data accessible to the Java SE process. No public proof-of-concept code has been identified at time of analysis.