This vulnerability affects the Scripting component of Oracle Java SE versions 8u491, 8u491-perf, and 11.0.31. It is difficult to exploit but allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Java SE. The vulnerability can be triggered using APIs, for example through web services supplying data to these APIs, and also applies to sandboxed Java Web Start applications or applets that load untrusted code relying on the Java sandbox for security. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with no availability impact. Oracle’s July 2026 Critical Patch Update advisory references patches for Oracle Java SE but does not explicitly confirm the patch status for this specific vulnerability.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Java SE. This impacts confidentiality and integrity of data but does not affect availability. The vulnerability can be exploited remotely without authentication but requires high attack complexity. There are no known exploits in the wild at this time.

Oracle has released a Critical Patch Update advisory in July 2026 that includes security patches for Oracle Java SE among many other products. However, the advisory does not explicitly confirm the patch status for CVE-2026-47058. Users should review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until patches are applied, users should exercise caution when running untrusted Java code, especially in sandboxed environments. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.