PT-2026-3697 · Oracle+1 · Oracle Java Se+3

Published 2026-01-20 · Updated 2026-05-08 · CVE-2026-21947

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u471-b50

Description A difficult-to-exploit issue exists in Oracle Java SE (JavaFX component) that allows an unauthenticated attacker with network access, via multiple protocols, to compromise the software. Successful attacks require interaction from a user other than the attacker and can result in unauthorized modification of Oracle Java SE data. This issue applies to Java deployments that load and execute untrusted code, such as Java Web Start applications or applets, relying on the Java sandbox for security. It does not affect server deployments running only trusted code.

Recommendations Update Oracle Java SE to a version later than 8u471-b50.

Fix

XSS

Out of bounds Read

Weakness Enumeration

CWE-79

CWE-125

Related Identifiers

BDU:2026-00827

BIT-JAVA-2026-21947

BIT-JAVA-MIN-2026-21947

BIT-JRE-2026-21947

CVE-2026-21947

OPENSUSE-SU-2026:10204-1

Affected Products

Java Platform

Javafx

Oracle Java Se

Red Os

References · 19

• https://osv.dev/vulnerability/BIT-java-2026-21947 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2026.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-21947 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-jre-2026-21947 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10204-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21947 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21947 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00827 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-21947 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21947 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-java-min-2026-21947 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-java-1-8-0-openjdk-cve-2026-21947-8.0 · Note
• https://cybersecurity-help.cz/vdb/SB20260120153 · Note
• https://suse.com/security/cve/CVE-2026-21947 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-java-1-8-0-openjdk-cve-2026-21947-7.3/?sphrase_id=1451730 · Note