CVE-2026-47035 is a vulnerability in the JavaFX component of Oracle Java SE version 8u491. It allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, but exploitation is difficult and requires user interaction from a person other than the attacker. The vulnerability can result in unauthorized update, insert, or delete access to data accessible by Oracle Java SE. This issue affects client-side Java deployments that run sandboxed Java Web Start applications or applets loading untrusted code relying on the Java sandbox for security. Server-side deployments running only trusted code are not affected. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory does not explicitly mention a patch or remediation for this specific vulnerability, and no known exploits in the wild have been reported.

The vulnerability can lead to unauthorized modification (update, insert, or delete) of some data accessible by Oracle Java SE when exploited. There is no impact on confidentiality or availability. Exploitation requires network access, high attack complexity, and user interaction from a third party, limiting the likelihood and scope of successful attacks. The overall impact is low.

Patch status is not yet confirmed — check the vendor advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly when available. Since no explicit patch or fix is stated for this vulnerability in the advisory, users should monitor Oracle's updates and apply any future patches addressing this issue. Additionally, avoid running untrusted Java Web Start applications or applets, and consider restricting or disabling Java Web Start usage in client environments to reduce exposure.