What is the CVSS score of CVE-2026-47058?

CVE-2026-47058 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Java SE are affected by CVE-2026-47058?

A high-severity vulnerability in Oracle Java SE versions 8u491 and 11.0.31 allows remote unauthenticated attackers to access and modify data handled by Java applications through the Scripting…. A patch is available.

How to fix or mitigate CVE-2026-47058?

Within 24 hours, inventory all systems running Oracle Java SE 8u491, 8u491-perf, or 11.0.31 and assess network exposure of Java-accessible APIs. Within 7 days, implement compensating controls including network segmentation to restrict API access, disable Java Web Start and applet execution where operationally feasible, and restrict Scripting component usage to trusted code only. Within 30 days, monitor Oracle security advisories for patch availability and establish an upgrade plan to move affected systems to patched Java versions; configure security monitoring to detect suspicious API access patterns.

Oracle Java SE CVE-2026-47058

EUVD-2026-46544 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-21 oracle

GHSA-j75p-jh2f-6h9p

Authentication Bypass Java Oracle Oracle Java Se Deserialization

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable via scripting APIs with no auth or interaction (AV:N/PR:N/UI:N), but special data-flow conditions make it hard (AC:H); full data read/write (C:H/I:H) and no availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:14 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High Severity Jul 22, 2026

AnalysisAI

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 allows a remote unauthenticated attacker to compromise the confidentiality and integrity of all Java-accessible data via APIs reachable over multiple network protocols. Rated CVSS 3.1 7.4 (High) by Oracle, the flaw is difficult to exploit (AC:H) and carries no availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach network service exposing scripting API

Delivery

Supply crafted untrusted data to Scripting APIs

Exploit

Trigger sandbox/access-control weakness (AC:H)

Execution

Bypass intended restrictions in JVM

Impact

Read and modify all Java-accessible data

Access

Reach network service exposing scripting API

Delivery

Supply crafted untrusted data to Scripting APIs

Exploit

Trigger sandbox/access-control weakness (AC:H)

Execution

Bypass intended restrictions in JVM

Impact

Read and modify all Java-accessible data

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target application route attacker-controlled data into the Oracle Java SE Scripting (javax.script/Nashorn) APIs - for example a web service that supplies untrusted data to those APIs - or, on the client side, that the victim run a sandboxed Java Web Start application or Java applet that loads and executes untrusted code and depends on the Java sandbox for security. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4) shows the strongest driver is that exploitation requires no privileges and no user interaction over the network, but the High attack complexity (AC:H) materially lowers real-world exploitability - Oracle explicitly calls it 'difficult to exploit,' meaning attackers likely need special conditions (specific data flow into scripting APIs or a sandboxed-code path) rather than a trivial one-shot request. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends specially crafted data to a network-facing service (for example a web service) that forwards that input into Oracle Java SE's Scripting APIs, or lures a client into running a sandboxed Java Web Start app/applet that loads attacker-controlled code. By meeting the specific conditions the flaw requires, the attacker escapes intended restrictions and reads or modifies all Java-accessible data. …
Remediation	Apply the fixed releases from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - upgrade Java SE 8u491/8u491-perf and 11.0.31 to the corresponding patched CPU builds; exact fixed version strings are enumerated in that advisory and should be taken from it directly rather than assumed. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running Oracle Java SE 8u491, 8u491-perf, or 11.0.31 and assess network exposure of Java-accessible APIs. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-502 – Deserialization of Untrusted Data

View all

CVE-2021-35464 CRITICAL POC

9.8

CVE-2020-10189 CRITICAL POC

9.8

CVE-2019-18935 CRITICAL POC

9.8

CVE-2015-7450 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

CVE-2021-42237 CRITICAL POC

9.8

CVE-2025-24016 CRITICAL POC

9.9

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2017-10271 HIGH POC

7.5

CVE-2015-1427 CRITICAL POC

9.8

CVE-2025-3248 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-47058 vulnerability details – vuln.today

Back

Oracle Java SE CVE-2026-47058

Severity by source

CVSS VectorVendor: oracle

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Java

Same weakness CWE-502 – Deserialization of Untrusted Data

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code