What is the CVSS score of CVE-2026-47034?

CVE-2026-47034 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle JavaFX CVE-2026-47034

EUVD-2026-46520 LOW

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-c6vv-q92q-68pg

Authentication Bypass Java Oracle Oracle Java Se Oracle Corporation

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Network vector applies to client-side content loading; AC:H and UI:R reflect mandatory user interaction and sandboxed-client deployment prerequisite; only limited integrity impact with no confidentiality or availability effect confirmed.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:43 vuln.today

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

AnalysisAI

Integrity bypass in Oracle Java SE's JavaFX component (version 8u491) allows a network-reachable unauthenticated attacker to perform limited unauthorized data modifications against clients running sandboxed Java Web Start applications or sandboxed Java applets. The attack requires high complexity and mandatory user interaction, constraining its practical impact to low-severity integrity effects (CVSS 3.1 score: 3.1). No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; server-side Java deployments are explicitly excluded from the attack surface by Oracle.

Technical ContextAI

JavaFX is a client-side rich application framework bundled with Oracle Java SE 8. This vulnerability resides in the JavaFX component and is scoped exclusively to Java deployments where the JVM loads and executes untrusted code within a security sandbox - the Java applet and Java Web Start execution model. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_java_se:*:*:*:*:*:*:*:*, with Oracle confirming only Java SE 8u491 as affected in the July 2026 CPU. No CWE has been assigned, and the 'Authentication Bypass' tag present in the source intelligence appears to be a taxonomy misclassification: the description describes a sandbox integrity bypass rather than a credential or session authentication weakness. The root cause class is most consistent with a sandbox policy enforcement failure within JavaFX's privileged API surface, allowing untrusted code to cross sandbox boundaries and affect data integrity.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update (CPU), which addresses this vulnerability; the advisory is available at https://www.oracle.com/security-alerts/cpujul2026.html. An exact patched version string beyond the CPU release cycle is not independently confirmed at time of analysis - organizations should apply the Java SE 8 patch released as part of the July 2026 CPU. As a compensating control, disabling Java Web Start and Java applet execution on all client endpoints entirely eliminates the attack surface, since the vulnerability is exclusively exploitable in those sandboxed untrusted-code execution contexts; this control carries minimal operational impact in most modern environments where browser Java plugins are already deprecated across major browsers. Restricting client systems from fetching or launching untrusted Java content via network egress policy or application whitelisting provides additional defense-in-depth with low operational cost.