CVE-2026-47058 Overview
CVE-2026-47058 is a high-severity vulnerability in the Scripting component of Oracle Java SE. The flaw allows an unauthenticated attacker with network access to compromise confidentiality and integrity of data processed by Java SE. Exploitation is difficult but requires no user interaction and no privileges. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data, affecting Oracle Java SE versions 8u491, 8u491-perf, and 11.0.31. Attack paths include APIs exposed through web services and sandboxed Java Web Start applications or applets that load untrusted code.
Critical Impact
Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and full read access to all Java SE accessible data through untrusted scripting input.
Affected Products
- Oracle Java SE 8u491
- Oracle Java SE 8u491-perf
- Oracle Java SE 11.0.31
Discovery Timeline
- 2026-07-21 - CVE-2026-47058 published to NVD
- 2026-07-23 - Last updated in NVD database
- 2026-07 - Addressed in the Oracle July 2026 Security Alert
Technical Details for CVE-2026-47058
Vulnerability Analysis
The vulnerability resides in the Scripting component of Oracle Java SE. This component provides bridges between the Java runtime and script engines that can evaluate untrusted expressions. An unauthenticated attacker who can supply data to APIs in the Scripting component can compromise the Java process. Attack channels include remote web services that forward request data to scripting APIs, as well as sandboxed Java Web Start applications and applets loading code from the internet.
Oracle classifies exploitation as difficult, reflecting non-default conditions or timing constraints. However, once the preconditions are met, exploitation yields high impact to both confidentiality and integrity without affecting availability.
Root Cause
The issue maps to CWE-502: Deserialization of Untrusted Data. Improper handling of untrusted objects or expressions passed to Scripting APIs allows an attacker to influence object graphs or script evaluation in ways that bypass sandbox constraints. Applications that rely on the Java security sandbox to isolate remote or downloaded code are directly exposed.
Attack Vector
Exploitation occurs over the network across multiple protocols. Two dominant patterns apply. First, server-side services that accept attacker-controlled input and pass it into Scripting component APIs. Second, client-side Java runtimes executing sandboxed Web Start applications or applets that load untrusted code from a remote origin. No authentication or user interaction is required in either scenario. No verified public proof-of-concept exploit is available at the time of writing, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
// No verified public exploit is available for CVE-2026-47058.
// Refer to the Oracle July 2026 Security Alert for technical details.
Detection Methods for CVE-2026-47058
Indicators of Compromise
- Unexpected child processes spawned by java or javaw executables, particularly shells, script interpreters, or network utilities.
- Java processes making outbound network connections to unfamiliar hosts after processing external input to Scripting APIs.
- Serialized Java object payloads (magic bytes AC ED 00 05) appearing in HTTP request bodies or headers to web services.
- Java Web Start (.jnlp) files or applets loaded from untrusted origins invoking scripting engines such as Nashorn or third-party JSR-223 engines.
Detection Strategies
- Inventory endpoints and servers running Oracle Java SE 8u491, 8u491-perf, or 11.0.31 and flag any that expose scripting APIs to network input.
- Instrument application logs to record calls to javax.script.ScriptEngine and deserialization entry points such as ObjectInputStream.readObject.
- Correlate web service access logs with unusual Java runtime behavior, including new file writes to sensitive paths or unexpected class loading.
Monitoring Recommendations
- Alert on Java processes executing operating system commands, since scripting compromises frequently pivot to command execution.
- Monitor JVM configuration for disabled security managers or overly permissive java.policy files on internet-facing hosts.
- Track outbound egress from application servers to non-approved destinations following inbound requests carrying serialized or scripted content.
How to Mitigate CVE-2026-47058
Immediate Actions Required
- Apply the fixes published in the Oracle July 2026 Security Alert to all affected Java SE installations.
- Restrict network exposure of services that accept untrusted data into Scripting APIs until patches are deployed.
- Disable Java Web Start and browser applet execution on user endpoints that do not require it.
Patch Information
Oracle addressed CVE-2026-47058 in the July 2026 Critical Patch Update. Administrators should upgrade Oracle Java SE 8 and Java SE 11 to the versions specified in the Oracle July 2026 Security Alert. Both the standard and performance-optimized (-perf) distributions require updating.
Workarounds
- Remove or disable script engines that are not required by the application, including Nashorn and third-party JSR-223 engines.
- Enforce strict allow-lists for classes accepted by any Java deserialization endpoint using ObjectInputFilter.
- Block Java Web Start and applet MIME types at web proxies to prevent client-side loading of untrusted Java code.
- Isolate Java application servers in network segments that restrict outbound connections to approved destinations only.
# Example: enforce a global deserialization filter for Java 8u121+ and 11+
# Reject everything except explicitly allowed packages
export JAVA_TOOL_OPTIONS="-Djdk.serialFilter='!*;java.base/*;java.util.*'"
# Verify installed Java version
java -version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
