CVE-2026-47027 is a medium severity vulnerability in the Libraries component of Oracle Java SE and Oracle GraalVM editions. It affects multiple versions including 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1. The vulnerability allows an unauthenticated attacker with network access via multiple protocols to cause a partial denial of service (availability impact) without requiring privileges or user interaction. Exploitation can occur through APIs, including web services that supply data to the vulnerable component, and also affects sandboxed Java Web Start applications or applets that run untrusted code relying on the Java sandbox. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state if a patch is available or provide specific remediation instructions.

Successful exploitation of this vulnerability results in a partial denial of service (partial DoS) condition in Oracle Java SE, impacting availability. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely by an unauthenticated attacker via multiple network protocols. It affects both server-side Java SE deployments and client-side sandboxed Java Web Start applications or applets that execute untrusted code.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed, consider restricting network access to vulnerable Java SE services and limiting exposure of APIs that could be exploited. No vendor advisory states that no action is required or that the issue is already mitigated.