Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.4

OpenJDK 11 and Java SE allow remote data changes

CVE-2026-47058 · published 3 months ago
Summary

Versions of Java SE and OpenJDK 11 can be tricked into running code from the network without authentication. An attacker could create, delete, or modify files that Java can access, potentially compromising important data. Apply the latest Java updates or patches and limit network access to Java services.

What to do
  • Update canonical openjdk-lts to version 11.0.32+9-1ubuntu1~22.04.
  • Update canonical openjdk-8 to version 8u502-ga~us1-0ubuntu1~24.04.
  • Update canonical openjdk-lts to version 11.0.32+9-1ubuntu1~24.04.
  • Update canonical openjdk-8 to version 8u502-ga~us1-0ubuntu1~26.04.
  • Update canonical openjdk-lts to version 11.0.32+9-1ubuntu1~26.04.
  • Update canonical openjdk-8 to version 8u502-ga~us1-0ubuntu1~16.04.
  • Update canonical openjdk-lts to version 11.0.32+9-1ubuntu1~18.04.
  • Update canonical openjdk-8 to version 8u502-ga~us1-0ubuntu1~18.04.
  • Update canonical openjdk-lts to version 11.0.32+9-1ubuntu1~20.04.
  • Update canonical openjdk-8 to version 8u502-ga~us1-0ubuntu1~20.04.
  • Update canonical openjdk-8 to version 8u502-ga~us1-0ubuntu1~22.04.
  • Update canonical openjdk-8 to version 8u502-ga~us1-0ubuntu1.
  • Update canonical openjdk-lts to version 11.0.32+9-1ubuntu1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian openjdk-11 All versions
Ubuntu:22.04:LTS canonical openjdk-lts < 11.0.32+9-1ubuntu1~22.04
Fix: upgrade to 11.0.32+9-1ubuntu1~22.04
Ubuntu:24.04:LTS canonical openjdk-17 All versions
Ubuntu:24.04:LTS canonical openjdk-21 All versions
Ubuntu:24.04:LTS canonical openjdk-25 All versions
Ubuntu:24.04:LTS canonical openjdk-8 < 8u502-ga~us1-0ubuntu1~24.04
Fix: upgrade to 8u502-ga~us1-0ubuntu1~24.04
Ubuntu:24.04:LTS canonical openjdk-lts < 11.0.32+9-1ubuntu1~24.04
Fix: upgrade to 11.0.32+9-1ubuntu1~24.04
Ubuntu:26.04:LTS canonical openjdk-17 All versions
Ubuntu:26.04:LTS canonical openjdk-17-crac All versions
Ubuntu:26.04:LTS canonical openjdk-21 All versions
Ubuntu:26.04:LTS canonical openjdk-21-crac All versions
Ubuntu:26.04:LTS canonical openjdk-25 All versions
Ubuntu:26.04:LTS canonical openjdk-8 < 8u502-ga~us1-0ubuntu1~26.04
Fix: upgrade to 8u502-ga~us1-0ubuntu1~26.04
Ubuntu:26.04:LTS canonical openjdk-lts < 11.0.32+9-1ubuntu1~26.04
Fix: upgrade to 11.0.32+9-1ubuntu1~26.04
– oracle corporation oracle java se 8u491
Ubuntu:Pro:16.04:LTS canonical openjdk-8 < 8u502-ga~us1-0ubuntu1~16.04
Fix: upgrade to 8u502-ga~us1-0ubuntu1~16.04
Ubuntu:16.04:LTS canonical openjdk-9 All versions
Ubuntu:Pro:18.04:LTS canonical openjdk-lts < 11.0.32+9-1ubuntu1~18.04
Fix: upgrade to 11.0.32+9-1ubuntu1~18.04
Ubuntu:Pro:18.04:LTS canonical openjdk-17 All versions
Ubuntu:Pro:18.04:LTS canonical openjdk-8 < 8u502-ga~us1-0ubuntu1~18.04
Fix: upgrade to 8u502-ga~us1-0ubuntu1~18.04
Ubuntu:Pro:20.04:LTS canonical openjdk-lts < 11.0.32+9-1ubuntu1~20.04
Fix: upgrade to 11.0.32+9-1ubuntu1~20.04
Ubuntu:20.04:LTS canonical openjdk-13 All versions
Ubuntu:20.04:LTS canonical openjdk-16 All versions
Ubuntu:Pro:20.04:LTS canonical openjdk-17 All versions
Ubuntu:Pro:20.04:LTS canonical openjdk-21 All versions
Ubuntu:Pro:20.04:LTS canonical openjdk-8 < 8u502-ga~us1-0ubuntu1~20.04
Fix: upgrade to 8u502-ga~us1-0ubuntu1~20.04
Ubuntu:22.04:LTS canonical openjdk-17 All versions
Ubuntu:22.04:LTS canonical openjdk-18 All versions
Ubuntu:22.04:LTS canonical openjdk-21 All versions
Ubuntu:22.04:LTS canonical openjdk-25 All versions
Ubuntu:22.04:LTS canonical openjdk-8 < 8u502-ga~us1-0ubuntu1~22.04
Fix: upgrade to 8u502-ga~us1-0ubuntu1~22.04
– oracle jre 1.8.0
11.0.31
cpe:2.3:a:oracle:jre:1.8.0:update491:*:*:-:*:*:*
– oracle jdk 1.8.0
11.0.31
cpe:2.3:a:oracle:jdk:1.8.0:update491:*:*:-:*:*:*
Ubuntu:26.10 canonical openjdk-8 < 8u502-ga~us1-0ubuntu1
Fix: upgrade to 8u502-ga~us1-0ubuntu1
Ubuntu:26.10 canonical openjdk-lts < 11.0.32+9-1ubuntu1
Fix: upgrade to 11.0.32+9-1ubuntu1
Original advisory text
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthent...
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published21 Jul 2026
Updated4 Nov 2026
First seen21 Jul 2026
Sources
CVE-2026-47058 · NVD
CVE-2026-47058 · MITRE
DEBIAN-CVE-2026-47058 · OSV
UBUNTU-CVE-2026-47058 · OSV
Track software like this
Free during beta