Cloudanix VulnDB

CVE-2026-47058

High · 7.4

CVSS

7.4

EPSS

0.4%

Published

Jul 21, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in certain versions of Java lets attackers who reach the system tamper with or steal important data without needing a password, so organizations should update their Java software to stop this from happening.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Data Tampering
Component
Library
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Authorization bypass in the Scripting component of Oracle Java SE that permits an unauthenticated network attacker to create, delete, or modify critical data and gain unauthorized access to all accessible data when untrusted code is loaded via APIs or sandboxed applications.

Why it matters to the business

Organizations running affected Java deployments face risk of data tampering and leakage in client-side or server-side environments that process untrusted input, potentially disrupting operations and exposing sensitive information across widely deployed Java runtimes.

How an attack unfolds

An attacker identifies a Java deployment accepting untrusted code or API calls over network protocols, crafts input that bypasses sandbox restrictions in the Scripting component, and leverages the flaw to perform unauthorized data operations without authentication.

How to fix it

Upgrade affected packages to the fixed versions listed in RHSA-2026:42882: java-11-openjdk on RHEL 7/8/9 to 11.0.32.0.9-1, java-1.8.0-openjdk on RHEL 7/8/9 to 1.8.0.502.b07-1.1, java-1.8.0-ibm on RHEL 8 to 1.8.0.8.70-1.el8_10, and equivalent portable/openjdk-windows updates for java-1.8.0 and java-11. Disable untrusted code execution where possible until patched.

How to confirm the fix worked

Verify Java version strings match the fixed releases above, test that Scripting component APIs no longer permit unauthorized data operations from untrusted input, and confirm sandbox restrictions enforce authorization checks.

Typical attack path

  1. Locate Java SE instances exposing Scripting APIs or loading untrusted code via network protocols
  2. Send crafted input through web services or sandboxed applets/Web Start applications
  3. Trigger authorization bypass to gain read/write access to critical data
  4. Perform creation, deletion, modification, or full access operations on target data

How to detect it

Review application logs for unexpected data modification or access patterns originating from network-facing Scripting calls or untrusted applet/Web Start executions; correlate with Java process activity handling external input.

What your security team should do

  • Prioritize patching all listed Red Hat Java packages to the exact fixed versions in RHSA-2026:42882 within standard change windows given 96 days of public disclosure
  • Inventory all Java 8 and 11 deployments and restrict network exposure of Scripting APIs
  • Apply compensating controls such as sandbox hardening and input validation until upgrades complete
  • Monitor for new exploit maturity indicators given stable low EPSS

The record

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities