CVE-2026-87286

Awaiting Analysis Awaiting Analysis - Queue

Remote Code Execution in Oracle GraalVM

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-87286

EUVD

EUVD-2026-79505

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	graalvm	25.0.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle GraalVM 25.0.4.1 affecting the Compiler component. It allows an unauthenticated attacker to remotely exploit the system via HTTP, potentially leading to a complete takeover of the GraalVM instance. The vulnerability has a high CVSS score of 8.1 due to its impact on confidentiality, integrity, and availability.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain full control over your Oracle GraalVM instance. This could lead to unauthorized access to sensitive data, modification or deletion of critical files, and disruption of services relying on the GraalVM.

Compliance Impact

This vulnerability allows remote attackers to take over Oracle GraalVM, potentially leading to unauthorized access, data breaches, or system compromise. Such incidents could violate GDPR (data protection), HIPAA (health data security), or other compliance requirements by exposing sensitive information or disrupting critical operations.

Mitigation Strategies

Update Oracle GraalVM to a version that is not affected by this vulnerability. Monitor Oracle's security alerts for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-87286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70