Is CVE-2026-47013 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47013 being exploited in the wild.

How severe is CVE-2026-47013?

Medium severity, with a CVSS score of 5.3, published 21 July 2026.

Is there a fix for CVE-2026-47013?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47013 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47013?

Check whether you run Oracle Java SE (JavaFX) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47013: Oracle Java SE partial denial of service in JavaFX

CVE-2026-47013 · Severity: medium · CVSS 5.3 · Published 2026-07-21

A vulnerability exists in the JavaFX component of Oracle Java SE, which is used for creating desktop and rich internet applications. An unauthenticated attacker could exploit this flaw over a network to cause a partial denial of service, potentially disrupting the availability of applications that rely on this software. This issue is particularly relevant for environments running sandboxed Java applications, such as those loaded from the internet.

Technologies: Oracle Java SE (JavaFX). Vendors: Oracle.

Quick answers

Is CVE-2026-47013 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47013 being exploited in the wild.
How severe is CVE-2026-47013?: Medium severity, with a CVSS score of 5.3, published 21 July 2026.
Which products and versions are affected?: Oracle Java SE (JavaFX) 8u491.
Is there a fix for CVE-2026-47013?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47013 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47013?: Check whether you run Oracle Java SE (JavaFX) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is located in the JavaFX component of Oracle Java SE version 8u491. It is classified as an easily exploitable flaw that allows an unauthenticated attacker with network access via multiple protocols to compromise the system. The primary impact is a partial denial of service (DoS) affecting the availability of the Java runtime. The vulnerability can be triggered through APIs in the JavaFX component, for instance, by a web service providing malicious data to those APIs. It also affects client-side deployments running sandboxed Java Web Start applications or applets that execute untrusted code from the internet. Oracle addressed this in the July 2026 Critical Patch Update.

Affected products

Oracle Java SE (JavaFX) 8u491

Timeline

2026-07-21: advisory: Initial publication by Oracle and NVD

References

https://www.oracle.com/security-alerts/cpujul2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.