CVE-2026-47059: Oracle Java SE Partial DOS Vulnerability

CVE-2026-47059 Overview

CVE-2026-47059 is a vulnerability in the 2D component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. Oracle disclosed the flaw as part of the July 2026 Critical Patch Update. An unauthenticated attacker with network access via multiple protocols can trigger a partial denial of service condition. The vulnerability is difficult to exploit and requires the target to load and execute untrusted code within the Java sandbox, such as sandboxed Java Web Start applications or Java applets. Server-side deployments running only trusted code are not affected. The weakness is classified under [CWE-284] Improper Access Control.

Critical Impact
Successful exploitation results in a partial denial of service against sandboxed Java client deployments. Confidentiality and integrity are not impacted.

Affected Products

Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1
Oracle GraalVM for JDK: 17.0.19 and 21.0.11
Oracle GraalVM Enterprise Edition: 21.3.18

Discovery Timeline

2026-07-21 - CVE CVE-2026-47059 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47059

Vulnerability Analysis

The vulnerability resides in the 2D component of Oracle Java SE and GraalVM distributions. The 2D subsystem provides low-level graphics rendering primitives used by AWT and Java2D APIs. An improper access control condition in this component allows a remote unauthenticated attacker to trigger a partial availability impact through crafted input processed via multiple network protocols.

The issue applies specifically to Java deployments that rely on the Java sandbox to isolate untrusted code. Client-side Java Web Start applications and Java applets that load code from the internet fall within this scope. Server-side deployments running only administrator-installed code are outside the attack surface.

Exploitation is documented as difficult, requiring specific conditions to be met before the denial of service condition is triggered. No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS probability score is 0.307%.

Root Cause

The root cause is improper access control [CWE-284] within the 2D graphics component. Insufficient enforcement of sandbox boundaries permits untrusted code paths to consume resources or trigger conditions that degrade service availability. Oracle has not released detailed root cause analysis beyond the advisory summary.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond the standard Java sandbox execution model. An attacker delivers untrusted code, such as a malicious applet or Web Start application, to a vulnerable Java client. The code invokes the affected 2D functionality to induce partial resource exhaustion or a hang condition in the JVM process. The AC:H attack complexity reflects the specialized preconditions required for reliable exploitation.

No verified exploitation code is publicly available. See the Oracle CPU July 2026 Alert for vendor-provided technical details.

Detection Methods for CVE-2026-47059

Indicators of Compromise

Unexpected JVM process hangs or high CPU utilization on client systems executing Java Web Start applications or applets.
Anomalous outbound network requests from javaw.exe or java processes fetching JAR files from untrusted domains.
Repeated JVM crashes or restarts on endpoints running vulnerable Oracle Java SE or GraalVM versions.

Detection Strategies

Inventory endpoints running affected Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition versions using software asset management tooling.
Monitor Java client processes for abnormal memory or CPU consumption patterns consistent with resource exhaustion.
Alert on execution of Java Web Start (javaws) processes launching content from external sources.

Monitoring Recommendations

Log and review outbound connections initiated by Java runtime processes to identify untrusted code retrieval.
Track JVM crash telemetry and correlate with recent applet or Web Start execution events.
Enable endpoint telemetry to record Java process command lines, loaded modules, and network activity for forensic review.

How to Mitigate CVE-2026-47059

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all affected Java SE and GraalVM installations.
Identify and remove Oracle Java SE and GraalVM builds listed as affected from endpoints that do not require them.
Disable Java content in web browsers on systems where sandboxed applet or Web Start execution is not a business requirement.

Patch Information

Oracle addressed CVE-2026-47059 in the July 2026 Critical Patch Update. Administrators should upgrade to the fixed release lines identified in the Oracle CPU July 2026 Alert. Update Oracle Java SE beyond versions 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1, and update GraalVM for JDK and GraalVM Enterprise Edition to the corresponding patched releases.

Workarounds

Restrict execution of Java Web Start applications and applets from untrusted sources through browser policy or application allowlisting.
Enforce Deployment Rule Sets or exception site lists to limit which signed applets and Web Start applications the JRE will execute.
Remove client-side Java plug-in support where feasible, as modern browsers no longer support NPAPI-based Java plug-ins.

bash

# Verify installed Java version on endpoints
java -version

# Example: disable Java content in browsers via deployment.properties
# (Windows: %APPDATA%\Sun\Java\Deployment\deployment.properties)
deployment.webjava.enabled=false
deployment.security.level=VERY_HIGH