CVE-2026-47058 is a high-severity vulnerability in the Scripting component of Oracle Java SE versions 8u491, 8u491-perf, and 11.0.31. It allows unauthenticated attackers with network access via multiple protocols to exploit APIs in the component, potentially leading to unauthorized creation, deletion, or modification of critical data or unauthorized access to all data accessible by Oracle Java SE. This vulnerability also affects Java deployments that run sandboxed Java Web Start applications or applets loading untrusted code relying on the Java sandbox for security. The CVSS 3.1 vector indicates network attack vector with high complexity, no privileges required, no user interaction, and high confidentiality and integrity impacts but no availability impact. The vendor advisory from Oracle does not explicitly confirm patch availability for this specific vulnerability but references a Critical Patch Update containing many patches. Users should verify patch status directly from Oracle's July 2026 Critical Patch Update advisory.

Successful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Java SE. This compromises confidentiality and integrity of the affected systems. The vulnerability can be exploited remotely without authentication but requires high attack complexity. There is no impact on availability reported.

Patch status is not explicitly confirmed for this vulnerability in the vendor advisory. Oracle recommends applying Critical Patch Updates promptly and staying on actively supported versions. Users should consult the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until patches are applied, users should be cautious about running untrusted Java Web Start applications or applets that rely on the Java sandbox for security.