CVE-2026-87287 in GraalVM
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within the compiler component of Oracle GraalVM, specifically affecting version 25.0.4.1 which is part of the broader Oracle Java SE ecosystem. This flaw represents a critical security deficiency in how the Just-In-Time (JIT) compiler processes certain code sequences during runtime optimization. The nature of this vulnerability allows an unauthenticated attacker to exploit it remotely over HTTP, indicating that no prior authentication or user interaction is required for exploitation. This characteristic significantly elevates the risk profile as any entity with network access to the service hosting GraalVM can potentially trigger the flaw without needing valid credentials or social engineering tactics such as phishing links.
From a technical perspective, compiler vulnerabilities often stem from improper validation of input data during the translation of bytecode into native machine code. In this instance, the difficulty in exploitation suggests that while the underlying logic error exists and is theoretically exploitable for arbitrary code execution, it may require specific conditions or precise timing to succeed consistently. However, once triggered, the impact is severe. The vulnerability leads directly to a complete takeover of the Oracle GraalVM process. This means an attacker can execute arbitrary commands with the privileges granted to the Java Virtual Machine process, effectively gaining full control over the underlying operating system environment where the JVM operates.
The operational impact of this compromise is substantial given the high severity rating assigned by Common Vulnerability Scoring System version 3.1. With a base score of 8.1 classified as High, the vulnerability affects all three pillars of the CIA triad: Confidentiality, Integrity, and Availability. The ability to take over the JVM allows attackers to exfiltrate sensitive data stored in memory or accessible by the application, thereby compromising confidentiality. It also permits modification of system files or database contents, violating integrity. Furthermore, an attacker could crash the service or consume excessive resources through denial-of-service techniques derived from the same exploit path, impacting availability. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that while access complexity is high and privileges required are none, the scope remains unchanged but all impact categories are rated as High.
In terms of industry standard classifications, this vulnerability aligns with CWE-94 Improper Control of Generation of Code or Command, commonly known as code injection, specifically within a compiler context where malicious input leads to unintended execution paths. It also maps to MITRE ATT&CK techniques related to Initial Access via Network Service and Execution through System Commands. The remote nature of the attack vector places it firmly in the realm of network-based exploits that target application layer services rather than local privilege escalation or physical access attacks.
Mitigation strategies must prioritize immediate patching if an updated version of Oracle GraalVM is available from official channels, as this appears to be a specific defect addressed in later releases. In environments where upgrading is not immediately feasible, defense-in-depth measures are critical. Network segmentation should be employed to restrict HTTP access to the JVM service only from trusted IP ranges or internal networks rather than exposing it directly to the public internet. Additionally, deploying Web Application Firewalls with rules designed to detect anomalous bytecode patterns or unusual JIT compilation triggers may help mitigate exploitation attempts. Monitoring system logs for unexpected process creation or privilege changes associated with the Java process can also aid in early detection of successful compromises. Regular vulnerability scanning and adherence to Oracle Critical Patch Update schedules are essential practices to maintain security posture against such compiler-level flaws.