Oracle Java SE EUVD-2026-46544

Exploitation requires that the target application route attacker-controlled data into the Oracle Java SE Scripting (javax.script/Nashorn) APIs - for example a web service that supplies untrusted data to those APIs - or, on the client side, that the victim run a sandboxed Java Web Start application or Java applet that loads and executes untrusted code and depends on the Java sandbox for security. Per CVSS PR:N/UI:N, no authentication and no user interaction are required, so exposure exists against reachable default runtimes, but the High attack complexity (AC:H) and Oracle's 'difficult to exploit' note indicate meaningful limiting factors: the attacker must control the specific data path into scripting and satisfy the special conditions that make the sandbox/access-control weakness trigger. Deployments that never expose scripting APIs to untrusted input and do not run untrusted sandboxed Java code are not realistically exploitable.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4) shows the strongest driver is that exploitation requires no privileges and no user interaction over the network, but the High attack complexity (AC:H) materially lowers real-world exploitability - Oracle explicitly calls it 'difficult to exploit,' meaning attackers likely need special conditions (specific data flow into scripting APIs or a sandboxed-code path) rather than a trivial one-shot request. Impact is meaningful: full read and write access to Java-accessible data (C:H/I:H) but no availability impact (A:N), so this is a data-compromise issue, not a crash/DoS. No EPSS score, no POC, and no KEV entry were provided, so there is no evidence of active or imminent exploitation; the absence of these signals combined with AC:H suggests this is a genuine but not front-of-queue priority - patch on the normal Oracle CPU cadence rather than emergency. The 'Authentication Bypass' tag conflicts somewhat with a pure scripting/sandbox-escape reading; treat the tag as vendor taxonomy rather than a confirmed auth-bypass primitive, and verify the exact affected code path against the Oracle July 2026 CPU advisory.

An attacker sends specially crafted data to a network-facing service (for example a web service) that forwards that input into Oracle Java SE's Scripting APIs, or lures a client into running a sandboxed Java Web Start app/applet that loads attacker-controlled code. By meeting the specific conditions the flaw requires, the attacker escapes intended restrictions and reads or modifies all Java-accessible data. No public proof-of-concept is identified at time of analysis, and the high attack complexity means the attacker must satisfy non-trivial preconditions rather than fire a simple payload.