CVE-2026-47059

High [CVE-2026-46968 +6] July 2026 Java Platform Standard Edition 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1 Vulnerabilities in NetApp Products

NTAP-20260724-0016Source published Jul 24, 2026Source updated Sep 1, 2026

This bulletin covers 7 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1 are susceptible to vulnerabilities that could allow an unauthenticated attacker with network access via multiple protocols including TLS to compromise Oracle Java SE. Refer to “Oracle Critical Patch Update Advisory - July 2026” for additional details. Successful attacks of these vulnerabilities can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data or unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as unauthorized read access to a subset of Oracle Java SE accessible data. Active IQ Unified Manager for…

Affected products in this advisory

• Active IQ Unified Manager for Microsoft Windows
• Active IQ Unified Manager for VMware vSphere
• Data Infrastructure Insights and Data Secure Storage Workload Security Agent

Source-reported affected versions

Affected-version details not available in this record.

Source-reported fixed versions

No fixed-version detail extracted. This does not mean no fix exists.

Mitigation guidance

• Data Infrastructure Insights and Data Secure Storage Workload Security Agent: Fixed as of 20260831.

Low [CVE-2026-47059] Enhance AWT ImagingLib (Oracle CPU 2026-07)

CVE-2026-47059Source published Jul 21, 2026Source updated Jul 21, 2026

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). A flaw was found in OpenJDK. When the software processes certain images, a specific function fails to manage memory boundaries…

Affected products in this advisory

• OPENJDK ELS 11.0.32
• Red Hat Build of OpenJDK 17.0.20
• Red Hat Build of OpenJDK 21.0.12
• Red Hat Build of OpenJDK 25.0.4

21 more entries in the full advisory.

Source-reported affected versions

• 11.0.31
• 17.0.19
• 21.0.11
• 25.0.3

1 more entries in the full advisory.

Source-reported fixed versions

• java-11-openjdk-portable
• java-11-openjdk-windows
• java-17-openjdk-portable
• java-17-openjdk-windows

46 more entries in the full advisory.

Mitigation guidance

• Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.