CVE-2026-83374 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products. This flaw affects a specific range of supported versions including Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition version 21.3.19.1.1. The core technical nature of this vulnerability is characterized by a difficult-to-exploit flaw that permits an unauthenticated attacker to compromise the integrity of the Java runtime environment. Unlike vulnerabilities that allow for remote code execution or denial of service, this specific issue targets data integrity, allowing attackers to create, delete, or modify critical data accessible through the affected components. The attack vector is network-based and operates across multiple protocols, indicating that the vulnerability can be triggered remotely without requiring prior authentication credentials from the attacker.
The operational impact of this vulnerability centers on unauthorized modifications to sensitive information within the Java environment. Successful exploitation enables an adversary to alter or destroy critical data stored by Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition applications. This integrity violation is particularly severe in environments where these technologies are deployed as clients running sandboxed Java Web Start applications or sandboxed Java applets. In such deployments, the application relies on the Java security manager to enforce a sandbox that restricts untrusted code from accessing local resources. However, this vulnerability allows malicious actors to bypass or undermine these restrictions when loading and executing untrusted code sourced from the internet. The ability to manipulate data undermines trust in the application's output and can lead to significant business logic errors, financial loss, or reputational damage depending on the nature of the affected system.
From a technical perspective, this vulnerability is exploitable through APIs within the specified component, particularly when those APIs are invoked by external services such as web services that supply data directly to them. This suggests that the flaw may involve improper validation or handling of input data passed via these interfaces, leading to unintended state changes in memory or persistent storage. The complexity of exploitation is rated as high, which aligns with a CVSS 3.1 Base Score of 5.9 and an Attack Complexity rating of High. This indicates that while the vulnerability exists, successful exploitation requires specific conditions or sophisticated techniques beyond simple automated scanning tools. The absence of required privileges for the attacker further highlights the severity of the breach in unauthenticated contexts, although the high complexity acts as a natural deterrent against casual abuse.
In terms of industry standard classifications, this vulnerability maps to CWE-922, which covers Insecure Storage of Sensitive Information or CWE-602, Client-Side Enforcement of Server-Side Security Controls, depending on whether the data is stored locally or processed in memory during transmission. The attack pattern aligns with MITRE ATT&CK technique T1537, Transfer Data to Cloud Account via API, if the modification involves exfiltration or cloud-based storage manipulation, or more broadly T1048, Exfiltration Over Alternative Protocol, given the multi-protocol nature of the access vector. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) explicitly confirms that while confidentiality and availability remain unaffected in this specific scenario, integrity is critically compromised with no user interaction required for exploitation if the API endpoint is exposed.
Mitigation strategies must prioritize immediate patching to the latest available versions of Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition provided by Oracle Security Updates. Organizations should verify their inventory against the listed affected version numbers and apply patches as soon as they are released through official channels. In environments where immediate patching is not feasible due to operational constraints, network-level controls such as Web Application Firewalls (WAFs) can be configured to inspect incoming traffic on the relevant protocols for anomalous patterns associated with API abuse or malformed data structures that trigger this flaw. Additionally, strict input validation and sanitization should be enforced at the application layer for any APIs exposed externally. For deployments involving sandboxed Java applets or Web Start applications, it is advisable to review security policies and consider migrating away from legacy technologies like Applets which are deprecated and pose inherent risks due to their reliance on browser-based sandboxes that may not fully mitigate modern attack vectors. Regular auditing of API endpoints and monitoring for unusual data modification patterns can also aid in early detection and response to potential exploitation attempts.