CVE-2026-87287

Awaiting Analysis Awaiting Analysis - Queue

Oracle GraalVM Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-04

NVD

CVE-2026-87287

EUVD

EUVD-2026-79506

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	graalvm	25.0.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle GraalVM 25.0.4.1 within the Compiler component. It allows an unauthenticated attacker to remotely exploit it via HTTP, potentially leading to a full takeover of the affected system. The vulnerability has a high CVSS score of 8.1 due to its impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking if Oracle GraalVM version 25.0.4.1 is installed. Use commands like 'graalvm --version' or inspect installation directories. Monitor network traffic for unusual HTTP requests targeting GraalVM components.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain complete control over your Oracle GraalVM instance. This could lead to unauthorized access to sensitive data, modification or deletion of critical files, and disruption of services relying on the GraalVM environment.

Compliance Impact

The vulnerability allows unauthenticated attackers to compromise Oracle GraalVM, potentially leading to unauthorized access, data breaches, or system takeover. This could impact compliance with GDPR by risking personal data exposure and HIPAA by compromising protected health information integrity and availability.

Mitigation Strategies

Upgrade Oracle GraalVM to a patched version if available. Restrict network access to GraalVM services via firewalls. Apply Oracle's security patches promptly. Disable HTTP interfaces if not required.

Hi! I’m here to help you understand CVE-2026-87287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70