Oracle Java SE CVE-2026-47059

Exploitation requires the target to be running a sandboxed Java Web Start application or a sandboxed Java applet that loads and executes untrusted code sourced from the internet and relies on the Java security sandbox for containment - Oracle explicitly states this vulnerability does not apply to server-side Java deployments loading only trusted, administrator-installed code. The high attack complexity (AC:H) indicates additional non-trivial conditions, such as specific timing, race conditions, or environmental state, must be met for exploitation to succeed. Although no authentication is required from the attacker (PR:N per CVSS), the practical constraint is the client-side sandboxed deployment model, which is a non-default and increasingly rare configuration given Java Web Start's removal from JDK 11+ and the deprecation of browser applets.

The CVSS 3.1 score of 3.7 (Low) accurately reflects a combination of attenuating factors. The network vector (AV:N) and absence of required privileges (PR:N) are offset by high attack complexity (AC:H), indicating non-trivial exploitation prerequisites such as race conditions, precise timing, or specific environmental state. The impact is bounded to partial availability (A:L) with no confidentiality or integrity consequences. No EPSS data was provided, and the vulnerability does not appear in the CISA KEV catalog, with no public exploit code identified. The most significant real-world risk reducer is the deployment scope restriction: Oracle explicitly states this does not affect server-side Java running trusted code - only sandboxed client environments loading internet-sourced untrusted code. Java Web Start was removed from the JDK in Java 11 and applet support has been deprecated for years, meaning the vulnerable deployment pattern has a shrinking footprint. For most enterprise Java environments, this CVE represents a low-priority patch rather than an urgent remediation item.

An attacker hosts malicious Java code on a network-accessible server and lures a client running a sandboxed Java Web Start application or browser applet into loading it. Once the untrusted code executes within the Java sandbox, it triggers a defect in the 2D rendering component via crafted input over a supported protocol, causing the Java process to become partially unresponsive or crash, denying service to the affected client session.