CVE-2026-47010 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition should apply security updates to prevent potential unauthorized data modifications. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for these products. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability is in the ImageIO component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It allows unauthenticated attackers with network access to compromise the products, potentially leading to unauthorized update, insert, or delete access to some accessible data. The CVSS 3.1 Base Score is 3.7 with a Vector of (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Affected versions include Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18.

Defensive priority

Apply security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition to prevent potential unauthorized data modifications.

Recommended defensive actions

• Apply security updates for Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition
• Restrict network access to affected products
• Monitor for suspicious activity
• Implement compensating controls
• Verify inventory of affected products
• Review and test backups
• Track exceptions and retest remediated assets

Evidence notes

The vulnerability affects multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is difficult to exploit and allows unauthenticated attackers with network access to compromise the products, potentially leading to unauthorized update, insert, or delete access to some accessible data. The affected versions include Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Defenders should verify inventory of affected products and apply security updates.

Official resources