Oracle JavaFX EUVD-2026-106722

Exploitation requires the target to be a client-side Java deployment that loads and runs untrusted code - specifically sandboxed Java Web Start applications or sandboxed Java applets that rely on the Java security sandbox - on affected Oracle JavaFX 25.0.4 or 27. It explicitly does NOT apply to server deployments that run only trusted/administrator-installed code. Key limiting factors: the attack is high-complexity (AC:H), and it mandates user interaction (UI:R) from a person other than the attacker, meaning a victim must actively load and run the attacker-supplied untrusted code; the sandboxed applet/Web Start deployment model is also deprecated in modern Java, further shrinking the realistic exploit surface. Impact is limited to read access to a subset of JavaFX data only.

This is a low-priority vulnerability by every available signal and should not be treated as an urgent remediation item. The CVSS 3.1 base score is only 3.1 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N: although the attack vector is network and no privileges are required (PR:N), exploitation is explicitly rated high complexity (AC:H), requires user interaction from a victim other than the attacker (UI:R), and yields only low-impact unauthorized read access to a subset of JavaFX data (C:L) with no integrity or availability impact. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit (POC) was identified - so no public exploit identified at time of analysis. Critically, the impact is confined to legacy client deployments running untrusted code through the Java sandbox (Java Web Start / applets); it does not apply to server deployments running only trusted code, which dramatically narrows the realistic attack surface. The 'Authentication Bypass' tag in the input conflicts with the actual vulnerability, which is a confidentiality-only information disclosure, not an authentication bypass - this mislabel should be disregarded. In short, this is a genuinely low real-world risk: a hard-to-exploit, user-interaction-dependent, low-confidentiality flaw in a largely retired deployment model.

An attacker hosts or links to a malicious sandboxed Java Web Start application or applet and socially engineers a victim into loading and running it in a browser or Java client that still supports the legacy sandbox. Because the flaw is high-complexity and interaction-dependent, the attacker must rely on a specific victim action and particular conditions aligning; if successful, the untrusted code gains unauthorized read access to a limited subset of JavaFX-accessible data. No public proof-of-concept exploit was identified in the provided data.