What is the CVSS score of CVE-2026-47059?

CVE-2026-47059 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-47059?

Yes, a patch is available for CVE-2026-47059. Update the affected software to the latest version immediately.

Oracle Java SE CVE-2026-47059

EUVD-2026-46545 LOW

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-c4gh-498r-f8f5

Authentication Bypass Denial Of Service Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation

3.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

3.7 LOW

Network reachable via multiple protocols but AC:H for sandbox and non-trivial exploitation conditions; impact limited to partial availability with no confidentiality or integrity loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:34 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

LOW 3.7

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).

AnalysisAI

Partial denial-of-service in the 2D component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to degrade availability via multiple network protocols. Affected versions span Java SE 8u491 through 26.0.1 and GraalVM for JDK 17.0.19/21.0.11, but exploitation is restricted to sandboxed client-side deployments - specifically Java Web Start applications or applets loading untrusted code - making the practical attack surface narrow given the near-obsolescence of these technologies. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

The vulnerability resides in the 2D rendering subsystem of the Oracle Java runtime, which handles graphics processing operations such as image rendering and font management. This component is present across Oracle Java SE (cpe:2.3:a:oracle_corporation:oracle_java_se), Oracle GraalVM for JDK (cpe:2.3:a:oracle_corporation:oracle_graalvm_for_jdk), and Oracle GraalVM Enterprise Edition (cpe:2.3:a:oracle_corporation:oracle_graalvm_enterprise_edition). No CWE has been assigned, so the precise root cause class - whether resource exhaustion, null pointer dereference, or a parsing defect within 2D graphics routines - is not disclosed by Oracle. The vulnerability is reachable via multiple protocols consistent with Java's broad networking stack (HTTP, HTTPS, RMI, JNDI, etc.), but only when the runtime is executing untrusted code within a security sandbox, the deployment model associated with Java Web Start or legacy browser applets.

RemediationAI

Apply the patches issued in Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact fixed version identifiers are not specified in the available data beyond the CPU release; consult the advisory directly to identify the precise patched build for your Java SE or GraalVM version. As an immediate compensating control for environments that cannot patch promptly, disable Java Web Start and browser applet functionality entirely - these are the only deployment modes through which this vulnerability is reachable, and disabling them eliminates the attack surface with no impact to server-side Java workloads. Organizations running only server-side Java with trusted, administrator-installed code are not exposed to this vulnerability per Oracle's own advisory scope and do not require emergency action.