This vulnerability in Oracle Java SE's Scripting component (CVE-2026-47057) affects versions 8u491, 8u491-perf, and 11.0.31. It allows an unauthenticated attacker with network access to cause a denial of service (DoS) by hanging or repeatedly crashing the Java SE runtime. Exploitation can occur via APIs exposed by the component, including through web services or sandboxed Java applications that load untrusted code. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and an impact limited to availability (denial of service). The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly state a patch or remediation level for this vulnerability, and no known exploits in the wild have been reported.

Successful exploitation results in an unauthorized denial of service condition by causing Oracle Java SE to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attack requires only network access and no authentication, making it easily exploitable. This can disrupt services or applications relying on the affected Java SE versions, potentially causing downtime or service unavailability.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available and remaining on actively supported versions. Until a patch is confirmed, consider limiting network exposure of affected Java SE components and restricting untrusted code execution where feasible.