CVE-2026-87294 in GraalVM Enterprise Edition
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Security component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products. This flaw affects a broad range of supported versions including Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, and 25.0.4.1, as well as Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1, and Oracle GraalVM Enterprise Edition version 21.3.19.1. The core issue stems from a logic error or improper validation within the security subsystem that governs how data is processed by specific application programming interfaces exposed to external inputs. This architectural weakness allows for unauthorized manipulation of internal state or data structures when these APIs are invoked with maliciously crafted arguments, bypassing expected access controls and integrity checks designed to protect sensitive information.
The operational impact of this vulnerability is significant due to its ease of exploitation and the breadth of attack vectors available to adversaries. An unauthenticated attacker can leverage network-accessible protocols to trigger the flaw without requiring any prior authentication or user interaction. The exploitability extends beyond traditional remote code execution scenarios, focusing instead on data integrity and confidentiality breaches. Successful exploitation enables an attacker to perform unauthorized updates, inserts, or deletes against accessible data within the Java environment. Furthermore, it grants unauthorized read access to a subset of protected data. This capability is particularly dangerous in environments where these APIs are exposed through web services that supply dynamic data, as well as in client-side deployments such as sandboxed Java Web Start applications and applets that load untrusted code from the internet. In these contexts, the reliance on the Java sandbox for security is undermined by this flaw, allowing malicious scripts to escalate privileges or exfiltrate sensitive information despite being confined within a restricted execution environment.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and potentially CWE-798 Use of Hard-coded Credentials if specific authentication bypass mechanisms are involved in the API handling logic. The attack pattern corresponds to ATT&CK technique T1530 Data from Cloud Storage or T1046 Network Service Discovery depending on how the data is accessed, but more accurately maps to T1059 Command and Scripting Interpreter if script-based exploitation is used within applets, or generally to privilege escalation vectors where sandbox boundaries are breached. The CVSS 3.1 base score of 6.5 reflects a medium severity rating driven by high attack vector complexity (network), low complexity requirements, no privileges required for the attacker, and no user interaction needed. The impact metrics indicate limited confidentiality and integrity impacts with no effect on availability, suggesting that while data theft or modification is possible, service disruption is not the primary outcome of this specific flaw.
Mitigation strategies must prioritize immediate patching to the latest available versions provided by Oracle, which address these security flaws through corrected input validation logic and enhanced sandbox enforcement mechanisms. For organizations unable to immediately upgrade due to compatibility constraints, implementing strict network segmentation to limit access to systems running vulnerable Java components is essential. Additionally, deploying web application firewalls with rulesets capable of detecting anomalous API calls or malformed data structures associated with this vulnerability can provide a layer of defense in depth. It is also critical to review and restrict the use of legacy technologies such as Java Web Start and applets, which are increasingly deprecated due to their inherent security risks when interacting with untrusted code sources. Regular auditing of API endpoints exposed by these services should be conducted to ensure that only authorized and validated inputs are processed, thereby reducing the attack surface available to potential adversaries seeking to exploit this logic error for data compromise.