What is the CVSS score of CVE-2026-47035?

CVE-2026-47035 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle JavaFX CVE-2026-47035

EUVD-2026-46521 LOW

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-w56g-q7c4-9v8p

Authentication Bypass Java Oracle Oracle Java Se Oracle Corporation

3.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Network delivery with high complexity and mandatory user interaction; no privileges required; integrity-only, limited impact; scope unchanged; matches Oracle-provided vector independently.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:44 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

LOW 3.1

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: JavaFX). The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).

AnalysisAI

Limited integrity compromise in the JavaFX component of Oracle Java SE 8u491 allows unauthenticated remote attackers to perform unauthorized data manipulation through a high-complexity, user-interaction-dependent attack path. The attack surface is narrowly scoped to client-side deployments - specifically sandboxed Java Web Start applications or Java applets that load and run untrusted code from the internet; server-side deployments loading only trusted code are explicitly excluded. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its low CVSS score of 3.1 and the demanding exploitation prerequisites.

Technical ContextAI

JavaFX is a client-side rich-application UI framework bundled with Oracle Java SE 8. The affected product is Oracle Java SE 8u491, identified via CPE cpe:2.3:a:oracle_corporation:oracle_java_se:*:*:*:*:*:*:*:*. The vulnerability resides within the JavaFX subsystem and is disclosed through Oracle's Critical Patch Update (CPU) for July 2026. No CWE identifier has been assigned (listed as N/A), which limits root-cause classification; however, the advisory tags include 'Authentication Bypass', suggesting the flaw may involve a bypass of the Java sandbox security model or access-control boundaries within the JavaFX runtime, rather than traditional network authentication bypass. The vulnerability applies only to the client execution model where the JVM sandbox is relied upon as the primary security boundary against untrusted code loaded from the network.

RemediationAI

The primary remediation is to apply the Oracle Critical Patch Update for July 2026, which addresses this vulnerability in Oracle Java SE. Organizations should upgrade beyond Java SE 8u491 to the patched version released as part of that CPU; the exact fixed version is not independently confirmed in the available data beyond the advisory reference at https://www.oracle.com/security-alerts/cpujul2026.html. Where immediate patching is not possible, the most effective compensating control is to eliminate the attack surface entirely: disable or uninstall Java Web Start and remove any browser Java plugin, since the vulnerability only applies to client-side sandboxed deployments loading untrusted code from the internet. Organizations that do not run sandboxed Java Web Start applications or Java applets are not exposed to this specific vulnerability and require no additional action beyond the standard patch cycle.