Vulnerability in Oracle Java SE JavaFX Affects Unauthenticated Users
CVE-2026-21947

3.1LOW

Key Information:

Vendor

Oracle
Status
Oracle Java Se
Vendor
CVE Published:
20 January 2026

What is CVE-2026-21947?

A vulnerability exists in Oracle Java SE, specifically within the JavaFX component, allowing unauthenticated attackers with network access to compromise the system. This flaw primarily affects client deployments running sandboxed Java Web Start applications or applets that load untrusted code from the internet. Successful exploitation requires human interaction from a user other than the attacker, potentially granting unauthorized update, insert, or delete access to certain data managed by Oracle Java SE. The vulnerability does not impact server deployments that only execute trusted code. It is crucial for users to remain vigilant when running applications that rely on the Java sandbox for security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Oracle Java SE 8u471-b50

References

https://www.oracle.com/security-alerts/cpujan2026.html
vendor-advisory

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.