What is the CVSS score of CVE-2026-47058?

CVE-2026-47058 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Java SE are affected by CVE-2026-47058?

A high-severity vulnerability in Oracle Java SE versions 8u491 and 11.0.31 allows remote unauthenticated attackers to access and modify data handled by Java applications through the Scripting…. A patch is available.

How to fix or mitigate CVE-2026-47058?

Within 24 hours, inventory all systems running Oracle Java SE 8u491, 8u491-perf, or 11.0.31 and assess network exposure of Java-accessible APIs. Within 7 days, implement compensating controls including network segmentation to restrict API access, disable Java Web Start and applet execution where operationally feasible, and restrict Scripting component usage to trusted code only. Within 30 days, monitor Oracle security advisories for patch availability and establish an upgrade plan to move affected systems to patched Java versions; configure security monitoring to detect suspicious API access patterns.

Oracle Java SE CVE-2026-47058

EUVD-2026-46544 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-21 oracle

GHSA-j75p-jh2f-6h9p

Authentication Bypass Java Deserialization Oracle Oracle Java Se Oracle Corporation

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable via scripting APIs with no auth or interaction (AV:N/PR:N/UI:N), but special data-flow conditions make it hard (AC:H); full data read/write (C:H/I:H) and no availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.4 HIGH

qualitative

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:14 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.4

DescriptionCVE.org

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High Severity Jul 22, 2026

AnalysisAI

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 allows a remote unauthenticated attacker to compromise the confidentiality and integrity of all Java-accessible data via APIs reachable over multiple network protocols. Rated CVSS 3.1 7.4 (High) by Oracle, the flaw is difficult to exploit (AC:H) and carries no availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. It also affects sandboxed Java Web Start/applet deployments that run untrusted code and rely on the Java sandbox.

Technical ContextAI

The affected component is the Java SE Scripting subsystem, which in the JDK is the Nashorn/JSR-223 (javax.script) engine that executes script code (historically JavaScript) inside the JVM and is frequently reached indirectly when applications feed externally supplied data to scripting APIs. Oracle classifies this as difficult to exploit but network-reachable, consistent with a flaw that lets attacker-controlled script or data bypass expected security boundaries - the vendor tags reference 'Authentication Bypass' and the description explicitly cites reliance on the Java sandbox for untrusted code, implying a sandbox/type-safety or access-control weakness in how scripting handles untrusted input. No CWE was assigned by NVD/Oracle, so the precise root-cause class (e.g., improper access control or unsafe deserialization/reflection through the script engine) cannot be confirmed from the provided data. The single CPE (cpe:2.3:a:oracle_corporation:oracle_java_se) covers the Java SE runtime itself rather than a downstream application, so any service exposing scripting APIs to untrusted data is potentially in scope.

RemediationAI

Apply the fixed releases from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - upgrade Java SE 8u491/8u491-perf and 11.0.31 to the corresponding patched CPU builds; exact fixed version strings are enumerated in that advisory and should be taken from it directly rather than assumed. As a compensating control where immediate patching is not possible, avoid passing untrusted or externally supplied data to the Scripting/Nashorn (javax.script) engine and disable or remove the script engine from applications that do not require it, accepting the trade-off that any legitimate scripting functionality will break. For client-side risk, disable Java Web Start and the browser/applet plugin and do not run untrusted sandboxed Java code, at the cost of losing legacy applet/Web Start functionality. Network exposure of any service that forwards user input into scripting APIs should be restricted to trusted callers until patched.

More in Java

View all

CVE-2012-4681 CRITICAL Emergency POC

9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m

CVE-2015-7450 CRITICAL Emergency POC

9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti

CVE-2013-2465 CRITICAL Act Now POC

9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent

CVE-2011-3544 CRITICAL Act Now POC

9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug

CVE-2010-1871 HIGH Act Now POC

8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to

CVE-2012-1723 CRITICAL Emergency POC

9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up

CVE-2013-0422 CRITICAL Emergency POC

9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using

CVE-2012-0507 CRITICAL Emergency POC

9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up

CVE-2015-4852 CRITICAL Act Now POC

9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL Act Now POC

9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow

CVE-2017-3066 CRITICAL Act Now POC

9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla

CVE-2012-0391 CRITICAL Act Now POC

9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-502 – Deserialization of Untrusted Data

View all

CVE-2021-35464 CRITICAL POC

9.8

CVE-2020-10189 CRITICAL POC

9.8

CVE-2019-18935 CRITICAL POC

9.8

CVE-2015-7450 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

CVE-2021-42237 CRITICAL POC

9.8

CVE-2025-24016 CRITICAL POC

9.9

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

CVE-2026-47058 vulnerability details – vuln.today

Back

Oracle Java SE CVE-2026-47058

Severity by source

CVSS VectorVendor: oracle

Lifecycle Timeline

DescriptionCVE.org

Articles & Coverage 1

AnalysisAI

Technical ContextAI

RemediationAI

More in Java

Same weakness CWE-502 – Deserialization of Untrusted Data

Same technique Authentication Bypass

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code