What is the CVSS score of CVE-2026-47063?

CVE-2026-47063 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-47063?

Within 24 hours, conduct a complete inventory of all systems and applications running Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition, documenting which applications process untrusted external input through affected library APIs. Within 7 days, implement application-layer input validation and sanitization controls on all identified systems, restrict network access to Java services to trusted sources only via firewalls and security groups, and contact Oracle for interim guidance; evaluate migration to updated GraalVM Community Edition versions as an alternative if available. Within 30 days, establish a formal remediation plan prioritizing critical applications that process sensitive data or face internet exposure, and execute vendor-released patches immediately upon availability.

Oracle Java SE CVE-2026-47063

EUVD-2026-46549 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-vw39-pj36-hc59

Authentication Bypass Java Oracle Oracle Java Se Oracle Graalvm Enterprise Edition Oracle Graalvm For Jdk Oracle Corporation

7.5

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify Java service exposing affected API
Delivery

Send crafted data via network protocol
Exploit

Reach vulnerable Libraries API
Execution

Trigger unauthorized data modification
Impact

Corrupt or delete critical data

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the target application actually route attacker-controlled data into the affected Libraries APIs - Oracle names the concrete vector as 'through a web service which supplies data to the APIs' - or, alternatively, that the victim run the legacy sandboxed model (Java Web Start applications or Java applets that load untrusted internet code and rely on the Java sandbox). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed once such an API path is reachable over the network. The practical limiting factor is deployment shape: environments that never expose the vulnerable APIs to untrusted input, and that have retired applets/Web Start, have little realistic exposure despite the 7.5 score; impact is also bounded to data integrity only (no confidentiality or availability effect).
Impact	The signals are moderately consistent but not alarming. The CVSS vector (AV:N/AC:L/PR:N/UI:N) genuinely supports easy, unauthenticated, remote reachability, and Oracle's own 'easily exploitable' language reinforces this. However, the impact is narrow: integrity-only (I:H) with no confidentiality or availability loss, so this cannot directly leak secrets or crash a service - it corrupts or forges data. No EPSS score was provided in the input, no POC is referenced, and it is not in CISA KEV, so there is no evidence of real-world exploitation. SSVC-style reading: exploitation status = none/proof-of-concept-absent, technical impact = partial (integrity subset only), automatable = plausible given AV:N/AC:L/PR:N but unproven. Net: treat as a real but not emergency priority - high theoretical reach, bounded impact, and no confirmed exploitation. Note the caveat that actual exposure depends heavily on whether an application actually pipes untrusted data into the affected Libraries APIs, or runs the deprecated applet/Web Start sandbox model that most modern deployments have retired.
Exploit ScenarioDerived	An attacker identifies an internet-facing service built on an affected JDK that forwards user-supplied data into the vulnerable Libraries API, then sends crafted input over one of the supported protocols to trigger unauthorized modification, creation, or deletion of critical application data - for example tampering with records the service persists. No authentication or user interaction is required (PR:N/UI:N, AC:L), though no public exploit code is currently known.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 21, 2026

Unauthorized data modification in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition (Libraries component) lets a remote, unauthenticated attacker corrupt, create, or delete critical data by feeding crafted input to affected Java APIs, for example through a web service that passes data to those APIs. It carries CVSS 3.1 7.5 with an integrity-only impact (C:N/I:H/A:N) and is described by Oracle as easily exploitable over multiple network protocols. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ubiquity of the Java runtime makes patching a priority.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory, https://www.oracle.com/security-alerts/cpujul2026.html), upgrading each affected runtime to the fixed release published in that CPU for its train (8, 11, 17, 21, 25, 26 for Java SE; the corresponding 17/21 builds for GraalVM for JDK; and the fixed 21.3.x build for GraalVM Enterprise Edition); the input does not enumerate exact fixed build numbers, so pull them directly from the CPU release notes. Where immediate patching is not possible, reduce exposure by not passing untrusted, internet-sourced data into the affected Libraries APIs and by fronting exposed web services with strict input validation, accepting that this only narrows the attack surface rather than closing the flaw. For the sandbox-specific path, disable or remove Java Web Start and browser applet execution and avoid loading untrusted code under the Java sandbox - a low-cost control given both technologies are deprecated and rarely needed, with the trade-off of breaking any legacy applet/Web Start applications still in use.

Affected VersionsENISA

Oracle GraalVM for JDK 17.0.19

Oracle GraalVM for JDK 21.0.11

Oracle Java SE 26.0.1

Oracle GraalVM Enterprise Edition 21.3.18

Oracle Java SE 8u491-perf

Oracle Java SE 21.0.11

Oracle Java SE 17.0.19

Oracle Java SE 8u491

Oracle Java SE 25.0.3

Oracle Java SE 11.0.31

Affected Packages

euvd oracle_graalvm_enterprise_edition no fix

euvd oracle_graalvm_for_jdk no fix

euvd oracle_java_se no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw resides in the core Libraries component shared across the Oracle JDK/JRE, GraalVM for JDK, and GraalVM Enterprise Edition - the foundational class libraries (java.*, sun.* utilities for parsing, serialization, or data handling) that virtually every Java application links against. Because the defect is in the runtime libraries rather than a single application, any process that routes untrusted input into the affected APIs is exposed; Oracle explicitly notes exploitation via APIs such as a web service supplying data. Oracle assigned no CWE (CWE: N/A), so the precise weakness class is unspecified, but the integrity-only, unauthenticated network profile is consistent with an input-validation or parsing defect that lets attackers manipulate data integrity without breaching confidentiality or availability. The advisory also flags the legacy sandbox path: sandboxed Java Web Start applications and applets that load untrusted internet-borne code and rely on the Java sandbox for isolation.

Know when Oracle Java Se gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI 7.5 HIGH

Oracle describes easy unauthenticated network exploitation via APIs (AV:N/AC:L/PR:N/UI:N) with impact limited to data integrity, so C:N/I:H/A:N and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE HIGH

Red Hat 7.5 HIGH

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

DescriptionCVE.org

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Articles & Coverage 1

News 6 New Java Vulnerabilities - 1 Critical, 5 High Severity Jul 22, 2026

Executive ViewAI

Why It Matters

Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition contain a data modification vulnerability (CVE-2026-47063) allowing remote, unauthenticated attackers to corrupt, create, or delete critical data through crafted input to Java library APIs; no public exploit identified at time of analysis. Every organization operating Java-based applications-particularly those exposing services to the network-faces immediate risk of unauthorized data manipulation. Given the ubiquity of Java in enterprise environments, ease of exploitation, and absence of vendor-released patches, this vulnerability demands immediate remediation.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Implement application-layer input validation to reject or sanitize untrusted data passed to Java library APIs; restrict network access to affected Java services to trusted internal networks only; disable unnecessary Java APIs that handle external input; deploy web application firewalls configured to detect suspicious data modification patterns; enable comprehensive audit logging on all data operations to detect compromise early.

Threat Intelligence Overview

EPSS Score

0.3%

Top 82% exploitable

Prevalence

Ubiquitous

Oracle JDK/JRE runs a huge fraction of enterprise and server environments

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Oracle Java Se

View all

CVE-2026-91403 CRITICAL Act Now POC

9.1 Oct 21

Unauthenticated remote attackers can read and tamper with critical data handled by Oracle Java SE through its JSSE (Java

CVE-2026-114820 CRITICAL Act Now

9.1 Oct 24

Remote unauthenticated compromise of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition is po

CVE-2026-47057 HIGH This Week

7.5 Jul 21

Denial-of-service in Oracle Java SE 8u491 (and 8u491-perf) and 11.0.31 lets an unauthenticated remote attacker hang or r

CVE-2026-34282 HIGH This Week

7.5 Apr 21

Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise E

CVE-2026-22016 HIGH This Week

7.5 Apr 21

Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises fro

CVE-2026-47058 HIGH This Week

7.4 Jul 21

Unauthorized data access and modification in the Scripting component of Oracle Java SE 8u491, 8u491-perf, and 11.0.31 al

CVE-2026-60147 MEDIUM This Month

6.5 Jul 21

Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counte

CVE-2026-22003 MEDIUM This Month

6.0 Apr 21

Integrity and availability compromise in Oracle Java SE's Hotspot component affects versions 8u481 and 8u481-b50, as wel

CVE-2026-46968 MEDIUM This Month

5.9 Jul 21

Integrity compromise via TLS in Oracle Java SE's JSSE component allows an unauthenticated remote attacker to perform una

CVE-2026-47027 MEDIUM This Month

5.3 Jul 21

Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt av

CVE-2026-47021 MEDIUM This Month

5.3 Jul 21

Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthent

CVE-2026-47013 MEDIUM This Month

5.3 Jul 21

Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated att

Same weakness CWE-284 – Improper Access Control

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back