CVE-2026-47034: Oracle Java SE Auth Bypass Vulnerability

CVE-2026-47034 Overview

CVE-2026-47034 is a vulnerability in the JavaFX component of Oracle Java SE version 8u491. An unauthenticated attacker with network access can exploit the flaw across multiple protocols, but successful exploitation requires user interaction from a person other than the attacker. The vulnerability maps to CWE-284: Improper Access Control and permits unauthorized update, insert, or delete access to a subset of Oracle Java SE data. Oracle documented the issue in the Oracle Security Alert July 2026.

Critical Impact
The vulnerability affects Java deployments running sandboxed Java Web Start applications or sandboxed Java applets that load untrusted code and rely on the Java sandbox for security. It does not affect server deployments that execute only trusted, administrator-installed code.

Affected Products

Oracle Java SE 8u491
JavaFX component within Oracle Java SE
Sandboxed Java Web Start applications and Java applets

Discovery Timeline

2026-07-21 - CVE-2026-47034 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47034

Vulnerability Analysis

The flaw exists in the JavaFX component distributed with Oracle Java SE 8u491. Exploitation is difficult and requires an attacker to lure a victim into running untrusted content inside a sandboxed Java context. When successful, the attacker gains limited integrity impact against Oracle Java SE, allowing unauthorized modification, insertion, or deletion of a subset of accessible data. Confidentiality and availability are not affected. The scope is unchanged, meaning the vulnerability does not cross a security authority boundary.

EPSS data from 2026-07-23 lists a probability of 0.217% at percentile 12.198, indicating a low predicted likelihood of near-term exploitation.

Root Cause

The root cause is improper access control [CWE-284] inside the JavaFX component. The sandbox fails to fully enforce restrictions on operations that modify data accessible to the Java runtime. Java deployments that only execute administrator-installed, trusted code are not exposed because they do not rely on the sandbox as a trust boundary.

Attack Vector

The attack is network-reachable across multiple protocols but demands user interaction. A typical scenario involves a victim launching a Java Web Start application or loading a Java applet that references attacker-controlled untrusted code. The untrusted code then abuses the JavaFX access control weakness to alter data reachable from the sandbox. No credentials are required, but attack complexity is high because the attacker must satisfy specific runtime conditions and rely on victim participation.

No verified public exploit code is available. See the Oracle Security Alert July 2026 for vendor-authored technical detail.

Detection Methods for CVE-2026-47034

Indicators of Compromise

Execution of Java Web Start (javaws.exe) or java.exe processes launching content sourced from untrusted internet locations.
Unexpected outbound network connections from Java runtime processes to attacker-controlled domains hosting .jnlp or applet payloads.
Unauthorized modification, insertion, or deletion of files or configuration data accessible to the Java runtime user context.

Detection Strategies

Inventory endpoints running Oracle Java SE 8u491 and flag any host still permitting sandboxed applet or Web Start execution.
Monitor process creation events where javaws.exe or java.exe is spawned by a browser or email client, correlated with network activity to external hosts.
Alert on JavaFX runtime loading .jnlp files or serialized JavaFX content originating from non-corporate network zones.

Monitoring Recommendations

Enable Java runtime deployment logging and centralize deployment.trace output in the SIEM for review.
Track child processes and file writes performed by Java runtimes to identify data modification consistent with integrity abuse.
Correlate endpoint telemetry with proxy logs to flag downloads of .jnlp, .jar, or JavaFX payloads from uncategorized domains.

How to Mitigate CVE-2026-47034

Immediate Actions Required

Apply the patch delivered in the Oracle Critical Patch Update, July 2026 to all Oracle Java SE 8u491 installations.
Disable Java content in browsers on endpoints that do not require sandboxed applets or Java Web Start applications.
Restrict execution of .jnlp files and applets to signed, allow-listed sources through Java Deployment Rule Sets.

Patch Information

Oracle released a fix as part of the July 2026 Critical Patch Update. Administrators should upgrade Oracle Java SE 8u491 to the patched release referenced in the Oracle Security Alert July 2026. Server deployments running only trusted code are not affected but should still be updated to maintain a consistent baseline.

Workarounds

Remove or disable the JavaFX runtime on systems that do not require it.
Enforce a Deployment Rule Set or Exception Site List that blocks untrusted .jnlp and applet URLs.
Configure browsers to disable the Java plugin and restrict Java Web Start associations at the operating system level.

bash

# Example: enforce a Deployment Rule Set path and disable unsigned applets
# /etc/.java/deployment/deployment.properties
deployment.security.level=VERY_HIGH
deployment.security.askgrantdialog.show=false
deployment.webjava.enabled=false
deployment.system.config.mandatory=true
deployment.user.security.exception.sites=/etc/.java/deployment/exception.sites