CVE-2026-47035: Oracle Java SE Auth Bypass Vulnerability

CVE-2026-47035 Overview

CVE-2026-47035 is a vulnerability in the JavaFX component of Oracle Java SE version 8u491. The flaw allows an unauthenticated network attacker to compromise integrity of the target when a user is tricked into interacting with malicious content. Exploitation is difficult and requires human interaction, limiting practical attack scenarios. The vulnerability affects Java deployments that load untrusted code through sandboxed Java Web Start applications or sandboxed Java applets. Server deployments running only administrator-installed trusted code are not impacted. Successful exploitation can result in unauthorized update, insert, or delete access to a subset of Oracle Java SE accessible data.

Critical Impact
An unauthenticated attacker with network access can achieve unauthorized modification of a subset of Java SE data if a user is lured into running a malicious sandboxed applet or Web Start application.

Affected Products

Oracle Java SE 8u491 (JavaFX component)
Sandboxed Java Web Start applications on affected versions
Sandboxed Java applet deployments on affected versions

Discovery Timeline

2026-07-21 - CVE-2026-47035 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47035

Vulnerability Analysis

The vulnerability resides in the JavaFX component of Oracle Java SE 8u491. It is categorized under [CWE-284] Improper Access Control, indicating that the sandbox boundary that separates untrusted code from privileged host resources is not fully enforced under specific conditions.

The issue is exploitable only in client-side Java deployments that rely on the sandbox to isolate untrusted code. Sandboxed Web Start applications and applets loaded from untrusted origins can leverage the flaw to modify a limited set of data accessible to the Java runtime. Confidentiality and availability are not impacted, and the attack complexity is high.

Exploitation requires user interaction. A victim must launch or continue running a malicious sandboxed application delivered from an attacker-controlled source.

Root Cause

The root cause is an access control weakness within the JavaFX component that permits sandboxed code to perform integrity-affecting operations beyond the intended trust boundary. Because the impact is limited to partial integrity (I:L) and no confidentiality or availability effect is present, the underlying condition appears to be a narrowly scoped policy or validation gap rather than a full sandbox escape.

Attack Vector

The attack path is network based over multiple protocols and depends on delivering a crafted JavaFX payload to a client that executes untrusted Java code. Typical delivery involves a malicious website, phishing lure, or Web Start descriptor that references attacker-controlled resources. Once the user runs the payload, the sandboxed code triggers the JavaFX code path to modify data reachable by the Java process. Because the flaw does not apply to server-side Java deployments, the primary risk surface is legacy desktop environments still executing untrusted applets or Web Start content.

No public proof-of-concept, exploit code, or CISA KEV listing is associated with this CVE. The EPSS probability is 0.175% (percentile 7.225) as of 2026-07-23.

Detection Methods for CVE-2026-47035

Indicators of Compromise

Java Web Start (javaws.exe) or javaw.exe processes launched by browsers or email clients loading .jnlp files from untrusted domains.
JavaFX runtime modules loaded by sandboxed processes that subsequently write to user-accessible data stores or configuration files.
Outbound HTTP or HTTPS requests from the Java process to newly observed or low-reputation hosts serving .jar or .jnlp content.

Detection Strategies

Inventory endpoints running Oracle Java SE 8u491 and flag hosts where the JavaFX runtime is enabled for browser or Web Start use.
Alert on process trees where a browser or mail client spawns javaws or a Java runtime that then modifies files outside the Java cache directory.
Correlate .jnlp file downloads with subsequent JavaFX process execution and outbound network activity.

Monitoring Recommendations

Log Java process command lines, loaded modules, and file writes at the endpoint layer for retrospective hunting.
Monitor web proxy logs for downloads of .jnlp, .jar, and JavaFX resources from unclassified or newly registered domains.
Track user interaction prompts related to Java security warnings that are dismissed before code execution.

How to Mitigate CVE-2026-47035

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert July 2026 to all Java SE 8 clients.
Remove Oracle Java SE 8u491 from endpoints that do not require it, prioritizing systems used for web browsing and email.
Disable Java content in browsers and restrict Java Web Start execution to signed applications from trusted origins.

Patch Information

Oracle addresses this vulnerability in the July 2026 Critical Patch Update. Consult the Oracle Security Alert July 2026 for the specific Java SE patch level and download instructions. Upgrade all affected Java SE 8 clients to the fixed release identified in that advisory.

Workarounds

Set the Java security level to Very High and remove all sites from the Exception Site List to block untrusted applets and Web Start applications.
Enforce application allow-listing so that only signed, trusted .jnlp and .jar files can execute on user endpoints.
Deploy browser policies that disable the Java plugin and block execution of javaws from browser or mail client parents.

bash

# Example: disable Java Web Start execution via Windows AppLocker rule (illustrative)
New-AppLockerPolicy -RuleType Path -Path "%ProgramFiles%\Java\jre1.8.0_491\bin\javaws.exe" -Action Deny -User Everyone

# Linux: remove Java Web Start binary from PATH for interactive users
sudo chmod 000 /usr/bin/javaws