Oracle JavaFX EUVD-2026-106655

Exploitation requires a Java deployment that still runs sandboxed Java Web Start applications or Java applets and loads untrusted code (e.g., code from the internet) relying on the Java sandbox for security. A human victim other than the attacker must actively load and run the malicious code (UI:R), and AC:H indicates additional conditions outside the attacker's control must align. It explicitly does NOT apply to typical server deployments that run only trusted, administrator-installed code, which sharply limits realistic exposure given the deprecation of the applet/Web Start model.

This is a genuinely low-priority issue despite being network-reachable and unauthenticated. The CVSS 3.1 base score is only 3.1 (LOW), and the vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) tells a consistent story: high attack complexity (AC:H), mandatory human interaction (UI:R), and impact limited to partial confidentiality disclosure (C:L) with no integrity or availability effect. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced - so no signal suggests real-world exploitation. Crucially, the description scopes the flaw to legacy sandboxed Java Web Start applications and Java applets that load untrusted code; Oracle explicitly states it does NOT apply to server deployments running trusted code. Since the applet/Web Start client model has been deprecated and removed from modern JDKs, the realistic exploitable surface is small. The only mild tension in the data is the 'Authentication Bypass' tag, which conflicts with the description - the actual impact is unauthorized read access to a data subset, not an authentication bypass; treat that tag as unreliable. Overall: low real risk, not a high-CVSS/low-risk mismatch - the CVSS itself already rates it low.

An attacker hosts a malicious Java applet or Java Web Start application on a website and lures a victim into loading and running it in a browser/JVM that still supports the sandbox model. The high complexity and required victim interaction make this difficult, and no public proof-of-concept is referenced; success yields only partial read access to data accessible to the sandboxed process.