CVE-2026-47057

highpriority · track · 0EPSS 0.005 · 40 %ileDEEUFRJPNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (40th) EPSS

CVSS 7.5 · high

Is it mine?

103 products

Check your exposure

Who says so?

8 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-23

Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · secalert_us@oracle.com USexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-190USCWE-269USCWE-400US

affected products (103)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Azul Zuluall versionscert_bundDEcpe:/a:azul:zulu:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
HCL BigFix Complianceall versionscert_bundDEcpe:/a:hcltech:bigfix:compliance
IBM App Connect Enterpriseall versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:-
IBM App Connect Enterprise 12.0.1.0-12.0.12.28all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.28
IBM App Connect Enterprise 13.0.1.0-13.0.8.1all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.8.1
IBM Business Automation Workflowall versionscert_bundDEcpe:/a:ibm:business_automation_workflow:-
IBM DB2all versionscert_bundDEcpe:/a:ibm:db2:-
IBM InfoSphere Information Server 11.7.0.0-11.7.1.6all versionscert_bundDEcpe:/a:ibm:infosphere_information_server:11.7.0.0_-_11.7.1.6
IBM Integration Bus for z/OS 10.1.0.0-10.1.0.7all versionscert_bundDEcpe:/a:ibm:integration_bus:for_zos_10.1.0.0_-_10.1.0.7
IBM Javaall versionscert_bundDEcpe:/a:ibm:jre:-
IBM Rational Business Developerall versionscert_bundDEcpe:/a:ibm:rational_business_developer:-
IBM Rational ClearQuestall versionscert_bundDEcpe:/a:ibm:rational_clearquest:-
IBM SPSSall versionscert_bundDEcpe:/a:ibm:spss:modeler
IBM Security Verify Accessall versionscert_bundDEcpe:/a:ibm:security_verify_access:-
IBM Semeru Runtime 11.0.12.0-11.0.30.0all versionscert_bundDEcpe:/a:ibm:semeru_runtime:11.0.12.0_-_11.0.30.0
IBM Semeru Runtime 17.0.0.0-17.0.19.0all versionscert_bundDEcpe:/a:ibm:semeru_runtime:17.0.0.0_-_17.0.19.0
IBM Semeru Runtime 21.0.0.0-21.0.10.0all versionscert_bundDEcpe:/a:ibm:semeru_runtime:21.0.0.0_-_21.0.10.0
IBM Semeru Runtime 25.0.0.0-25.0.2.0all versionscert_bundDEcpe:/a:ibm:semeru_runtime:25.0.0.0_-_25.0.2.0

showing 20 of 103

advisories (12)

Vendor and ecosystem advisories describing this.

NCSC-2026-0261Kwetsbaarheden verholpen in Oracle Java SENL2026-07-22csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Java SE (inclusief Oracle GraalVM en JavaFX componenten).
NCSC-2026-0321Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOSNL2026-08-21csaf · ncsc_nlNL
IBM heeft kwetsbaarheden verholpen in AIX en PowerVM VIOS. Ook heeft IBM eerdere kwetsbaarheden in, onder andere, DB2, WebSphere, Oracle producten als Java en GraalVM, PostgreSQL, OpenSSH en Perl verholpen voor de producten geproduceerd voor AIX.
WID-SEC-W-2026-2443Oracle Java SE: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2026-2858IBM AIX und VIOS: Mehrere SchwachstellenDeutsch2026-08-16csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM AIX und IBM VIOS ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, und um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2026-2958IBM License Metric Tool: Mehrere SchwachstellenDeutsch2026-08-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2026-3043IBM QRadar SIEM: Mehrere SchwachstellenDeutsch2026-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen und um beliebigen Programmcode auszuführen.
BIT-java-2026-470572026-08-17vendor · osvUS
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
BIT-java-min-2026-470572026-08-17vendor · osvUS
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
BIT-jre-2026-470572026-08-17vendor · osvUS
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CERTFR-2026-AVI-1336Multiples vulnérabilités dans les produits IBMFrançais2026-10-16vendor · certfrFR
JVNDB-2026-037830JVN iPedia advisory JVNDB-2026-0378302026-10-15vendor · jvndbJP
JVNDB-2026-037832JVN iPedia advisory JVNDB-2026-0378322026-10-15vendor · jvndbJP

also known as (7)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl certfr jvndb NVD CVE.org MITRE

published 2026-07-21modified 2026-09-22

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan