Oracle JavaFX CVE-2026-47035

Exploitation requires the target system to be running Oracle Java SE 8u491 with the JavaFX component present - specifically in a client-side deployment model where a sandboxed Java Web Start application or sandboxed Java applet loads and executes untrusted code sourced from the internet. The attack requires active human interaction: the target user must take a deliberate action to launch or interact with the malicious Java application. High attack complexity (AC:H) further implies non-default conditions or race conditions must be met, or the attacker requires preparation beyond simply delivering a payload. Exploitation is explicitly limited by: the requirement for the Java sandbox to be the active security boundary, mandatory user interaction (UI:R), the exclusive applicability to client-side deployments (not servers loading trusted code), high attack complexity (AC:H), and the practical rarity of active Java Web Start or browser-applet deployments in 2026. Server-side Java deployments are entirely out of scope per Oracle's own advisory language.

Real-world risk is low. The CVSS 3.1 base score of 3.1 reflects four significant exploitation barriers encoded in the vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N: high attack complexity (AC:H), mandatory human interaction (UI:R), no scope change (S:U), and impact limited exclusively to partial integrity (I:L) with no confidentiality or availability loss. EPSS data is not available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept or exploit code has been identified. The deployment scope is further constrained by the practical decline of Java Web Start and browser-based Java applets - both deprecated and unsupported in modern browsers - meaning the realistic population of exposed clients is small even within the Java SE 8 install base. The 'Authentication Bypass' tag is potentially misleading in isolation; in this sandbox context it likely refers to a security-model bypass rather than a credential bypass, and should be interpreted against the narrow client-side scope. Overall, this is a low-priority vulnerability unless an organization operates a specific client-side Java Web Start deployment loading internet-sourced untrusted code.

An attacker hosts a malicious Java Web Start application or Java applet on an attacker-controlled website and social-engineers a target user running Oracle Java SE 8u491 into launching it. The JavaFX component processes the untrusted, network-delivered code within the Java sandbox, and through an undisclosed high-complexity mechanism, the attacker is able to perform limited unauthorized insert, update, or delete operations on data accessible to the Java SE instance. No public proof-of-concept exists at time of analysis, and the high attack complexity and required user interaction make opportunistic mass exploitation unlikely.