Is CVE-2026-21947 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-21947 being exploited in the wild.

How severe is CVE-2026-21947?

Low severity, with a CVSS score of 3.1, published 20 January 2026.

Which products and versions are affected?

Oracle Java SE 8u471-b50; Siemens SIMATIC CN 4100 All versions < V5.0.

Is there a fix for CVE-2026-21947?

A patch was published on 2026-05-12: Siemens released SIMATIC CN 4100 V5.0 to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-21947 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-21947?

Check whether you run Oracle Java SE, Oracle Jdk, Oracle JRE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21947: Oracle Java SE XSS in JavaFX

Q: Is there a fix for CVE-2026-21947?

A patch was published on 2026-05-12: Siemens released SIMATIC CN 4100 V5.0 to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-21947 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-21947?

Check whether you run Oracle Java SE, Oracle Jdk, Oracle JRE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-21947 · Severity: low · CVSS 3.1 · Published 2026-01-20

A vulnerability in the JavaFX component of Oracle Java SE could allow an attacker to perform unauthorized data modifications. This issue primarily affects client-side Java deployments, such as sandboxed web applications or applets that run untrusted code from the internet. To be successful, an attacker must convince a user to interact with a malicious application, making it difficult to exploit in practice.

Technologies: Oracle Java SE, Oracle Jdk, Oracle JRE, Siemens SIMATIC CN 4100. Vendors: Oracle, Siemens.

Quick answers

Is CVE-2026-21947 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-21947 being exploited in the wild.
How severe is CVE-2026-21947?: Low severity, with a CVSS score of 3.1, published 20 January 2026.
Which products and versions are affected?: Oracle Java SE 8u471-b50; Siemens SIMATIC CN 4100 All versions < V5.0.
Is there a fix for CVE-2026-21947?: A patch was published on 2026-05-12: Siemens released SIMATIC CN 4100 V5.0 to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-21947 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-21947?: Check whether you run Oracle Java SE, Oracle Jdk, Oracle JRE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability exists in the JavaFX component of Oracle Java SE, specifically affecting version 8u471-b50. It is classified as a Cross-Site Scripting (XSS) vulnerability (CWE-79) by CISA-ADP. The attack is complex (AC:H) and requires human interaction (UI:R) from a user other than the attacker. It primarily impacts the integrity of data within sandboxed Java environments, such as Java Web Start or Java applets, where untrusted code is executed. Successful exploitation allows an attacker to perform unauthorized update, insert, or delete operations on accessible Java SE data. Oracle has addressed this in their January 2026 Critical Patch Update, and Siemens has released updates for affected SIMATIC CN 4100 devices.

Affected products

Oracle Java SE (JavaFX) 8u471-b50
Siemens SIMATIC CN 4100 All versions < V5.0

Timeline

2026-01-20: disclosed: Initial disclosure by Oracle
2026-01-20: advisory: NVD published CVE-2026-21947
2026-05-12: patched: Siemens released SIMATIC CN 4100 V5.0 to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.