Oracle Java SE CVE-2026-47057

Exploitation requires that the target Java application actually exposes the Scripting component (JSR-223 / Nashorn) APIs to attacker-influenced data - Oracle specifies this occurs 'by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs,' so a reachable code path that feeds untrusted input into javax.script is the concrete prerequisite. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration beyond that exposure are needed against affected versions (8u491, 8u491-perf, 11.0.31). The alternative client vector requires running a sandboxed Java Web Start application or applet that loads untrusted code. The principal limiting factor is that applications which never route external data into the Scripting APIs are not exploitable despite the network CVSS rating, and the applet/Web Start path depends on now-deprecated client technology.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes an easily reachable, unauthenticated, network-triggerable availability-only flaw - a genuine DoS priority for any Java service that exposes the Scripting APIs to untrusted input, but strictly limited to availability (no C or I impact). No EPSS score, KEV listing, SSVC decision, or POC was supplied, so exploitation probability cannot be quantified from the data; the appropriate reading is no public exploit identified at time of analysis rather than any evidence of active use. One nuance worth flagging to defenders: real-world exposure depends heavily on whether an application actually routes external/untrusted data into the Scripting component - a server that never invokes scripting on attacker-controlled input is not exploitable despite the AV:N rating, so raw CVSS overstates risk for the majority of deployments. Oracle also notes the sandboxed Java Web Start / applet client scenario, which is largely deprecated in modern environments and further narrows practical impact.

An attacker identifies a network-facing Java web service that forwards request data into the Scripting component's APIs and submits crafted input designed to drive the JVM into an unrecoverable hang or repeatable crash. Because the attack needs no authentication, no user interaction, and low complexity, a single or small number of malicious requests can take the service completely offline (complete DOS). No public proof-of-concept is identified at time of analysis.