CVE-2026-47063 is a vulnerability in the Libraries component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It affects specific versions including Oracle Java SE 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1; Oracle GraalVM for JDK versions 17.0.19 and 21.0.11; and Oracle GraalVM Enterprise Edition 21.3.18. The flaw allows an unauthenticated attacker with network access via multiple protocols to compromise the products by unauthorized creation, deletion, or modification of critical data. Exploitation can occur through APIs, such as web services supplying data to the vulnerable component, and also affects sandboxed Java Web Start applications or applets that run untrusted code relying on the Java sandbox. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a fix for this CVE in the provided content.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to perform unauthorized creation, deletion, or modification of critical data accessible through Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. This impacts data integrity but does not affect confidentiality or availability according to the CVSS vector. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of compromise in exposed environments.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively-supported versions. Until a patch is confirmed and applied, consider restricting network access to vulnerable services and carefully controlling the use of untrusted code in Java sandbox environments. No vendor advisory content explicitly states that no action is required or that the vulnerability is already mitigated.