CVE-2026-47010: Oracle Java SE Auth Bypass Vulnerability

CVE-2026-47010 Overview

CVE-2026-47010 is an improper access control vulnerability [CWE-284] in the ImageIO component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthenticated attacker with network access can exploit the flaw through multiple protocols to gain unauthorized update, insert, or delete access to a subset of accessible data. Oracle rates the issue difficult to exploit and assigns it a CVSS 3.1 base score of 3.7 with integrity-only impact. The vulnerability also affects Java deployments that run untrusted code, including sandboxed Java Web Start applications and sandboxed Java applets that rely on the Java sandbox for security.

Critical Impact
Successful exploitation allows unauthenticated network attackers to perform unauthorized modification of a limited subset of data processed by Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition.

Affected Products

Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1
Oracle GraalVM for JDK: 17.0.19, 21.0.11
Oracle GraalVM Enterprise Edition: 21.3.18

Discovery Timeline

2026-07-21 - CVE CVE-2026-47010 published to NVD as part of the Oracle Critical Patch Update cycle
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47010

Vulnerability Analysis

The flaw resides in ImageIO, the Java API responsible for reading, writing, and processing image data. ImageIO parsers accept complex, attacker-controllable byte streams and dispatch them to format-specific readers such as JPEG, PNG, GIF, and TIFF. When access control checks around these decoders are incomplete, crafted image inputs can trigger operations that modify data structures the caller should not be able to change.

Oracle categorizes the issue with integrity-only impact, meaning exploitation does not directly leak confidential data or cause outages. Instead, it produces unauthorized update, insert, or delete effects against data reachable by the vulnerable process. The attack complexity is high, indicating that reliable exploitation requires specific runtime conditions or crafted inputs.

Root Cause

The underlying weakness maps to [CWE-284] Improper Access Control. The ImageIO code path does not fully enforce authorization boundaries when handling untrusted image content, allowing operations that should be restricted to succeed under specific conditions. Sandboxed Java Web Start applications and applets that rely on the Java sandbox for isolation are explicitly listed as affected deployment models.

Attack Vector

Exploitation is remote and unauthenticated. An attacker delivers a crafted image or triggers ImageIO code paths through a web service that supplies data to the vulnerable APIs. Any server-side application that consumes user-supplied images with javax.imageio.* APIs is a candidate target. Client-side risk is limited to Java deployments that load untrusted code and depend on the Java sandbox, a shrinking but still relevant surface in legacy enterprise environments.

No public proof-of-concept exploit has been observed. The current EPSS probability is 0.252%.

Detection Methods for CVE-2026-47010

Indicators of Compromise

Unexpected inbound requests carrying malformed or oversized image payloads to endpoints that invoke javax.imageio.ImageIO.read or related APIs.
Java process exceptions or stack traces referencing com.sun.imageio or javax.imageio readers correlated with untrusted input.
Unauthorized modifications to application data records that immediately follow image upload or processing operations.

Detection Strategies

Inventory all Java runtimes against the affected version list and flag hosts running unpatched Oracle JDK, GraalVM for JDK, or GraalVM Enterprise Edition builds.
Instrument applications that call ImageIO to log source, size, and MIME type of every processed image for anomaly analysis.
Correlate application-tier writes with the identity and origin of the request that triggered them to surface unauthorized modifications.

Monitoring Recommendations

Alert on Java stack traces originating from ImageIO readers when processing externally sourced content.
Monitor egress and ingress patterns of services that parse user-supplied images for volumetric anomalies consistent with fuzzing or exploitation attempts.
Track Oracle Critical Patch Update compliance across production Java fleets and flag drift from the July 2026 baseline.

How to Mitigate CVE-2026-47010

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Java SE, GraalVM for JDK, and GraalVM Enterprise Edition installations.
Identify server-side applications that call ImageIO on untrusted input and prioritize them for patching.
Retire remaining Java Web Start and applet deployments that still depend on the Java sandbox as a trust boundary.

Patch Information

Oracle addressed CVE-2026-47010 in the July 2026 Critical Patch Update. Fixed versions supersede Java SE 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18. Refer to the Oracle Security Alert July 2026 for the exact patched build numbers and download locations.

Workarounds

Validate image content types, dimensions, and file sizes at the application boundary before invoking ImageIO APIs.
Isolate image processing in a sandboxed worker or container with least-privilege access to application data stores.
Disable or remove unused image format readers via the javax.imageio.spi.IIORegistry where feasible to shrink the attack surface.

bash

# Verify the installed Java version against the July 2026 CPU baseline
java -version

# Enumerate registered ImageIO readers to identify unnecessary format support
jshell -e 'javax.imageio.ImageIO.getReaderFormatNames();' | tr "," "\n"