CVE-2026-87286 in GraalVM
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Compiler component of Oracle GraalVM, specifically affecting version 25.0.4.1 which is part of the broader Oracle Java SE ecosystem. This security flaw represents a critical risk to systems relying on this specific iteration of the virtual machine and its associated Just-In-Time compilation capabilities. The nature of the defect allows for an unauthenticated attacker who possesses network access via HTTP to exploit the issue remotely without requiring any user interaction or prior authentication credentials. This characteristic significantly elevates the severity of the vulnerability, as it removes common barriers such as social engineering or credential theft that typically precede successful exploitation in other contexts. The ability to compromise the system through a standard web protocol indicates that the attack surface is exposed and accessible over typical network configurations, making detection and prevention reliant on strict input validation and secure coding practices within the compiler logic itself rather than perimeter defenses alone.
From a technical perspective, the vulnerability facilitates code execution or state manipulation at a level sufficient to achieve complete system takeover. This implies that an attacker can execute arbitrary commands with the privileges of the GraalVM process, potentially leading to full control over the underlying operating system and any applications running within that environment. The high impact on confidentiality, integrity, and availability is reflected in the CVSS 3.1 Base Score of 8.1, which classifies this as a High severity issue. The vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) highlights that while the attack complexity is rated as high due to specific conditions required for successful exploitation, the lack of authentication requirements and network accessibility make it a potent threat. Successful exploitation results in High impacts across all three core security metrics, meaning sensitive data can be exfiltrated, system configurations or data integrity can be altered maliciously, and service availability can be disrupted through denial-of-service techniques or resource exhaustion resulting from the compromise.
In terms of industry standard classifications, this vulnerability aligns with CWE-20 Improper Input Validation, as the compiler likely fails to adequately sanitize or verify inputs before processing them during compilation phases. It may also relate to CWE-94 Code Injection if the flaw allows for the injection and execution of malicious code snippets within the compiled output. Furthermore, from a tactical standpoint, this vulnerability maps to MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter or potentially T1203 Exploitation for Client Execution depending on how the compiler is invoked in the target environment. The remote nature of the attack places it within the Initial Access or Persistence phases if an attacker establishes a foothold, while the system takeover aspect relates to Privilege Escalation if the GraalVM process runs with elevated privileges relative to other services on the host machine. Understanding these mappings helps security teams prioritize remediation efforts and align their detection rules with known adversary behaviors associated with compiler vulnerabilities.
The operational impact of this vulnerability extends beyond immediate compromise, potentially affecting downstream applications that depend on Oracle Java SE for runtime execution. If an attacker gains control over GraalVM, they can manipulate the behavior of any application compiled or interpreted by it, leading to data breaches, unauthorized transactions, or lateral movement within a network infrastructure. The high availability impact suggests that attackers could also disrupt business operations by crashing services or consuming excessive resources during exploitation attempts. This necessitates immediate attention from system administrators and development teams responsible for maintaining Java-based environments. The presence of such a flaw in a core component like the compiler underscores the importance of rigorous code review processes and automated static analysis tools to identify similar issues before deployment.
Mitigation strategies should focus on both technical controls and procedural updates. The primary remediation is to apply the latest security patches provided by Oracle for GraalVM version 25.0.4.1 or upgrade to a supported, patched release where this compiler flaw has been resolved. Organizations must ensure their patch management processes are agile enough to deploy these fixes promptly given the remote exploitability of the issue. In addition to updating software, network segmentation and firewall rules should be reviewed to restrict HTTP access to systems running vulnerable versions of GraalVM, limiting exposure to trusted networks only where possible. Implementing Web Application Firewalls with robust rule sets can help detect and block exploitation attempts by identifying anomalous patterns in HTTP traffic directed at the compiler endpoints. Furthermore, deploying runtime application self-protection solutions or intrusion detection systems that monitor for unusual process behavior associated with Java compilation tasks can provide an additional layer of defense against successful exploits. Regular security assessments and penetration testing should be conducted to validate the effectiveness of these controls and identify any residual risks in the environment.