CVE-2026-87288

Awaiting Analysis Awaiting Analysis - Queue

Oracle GraalVM Remote Code Execution

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-87288

EUVD

EUVD-2026-79507

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	graalvm	25.0.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle GraalVM 25.0.4.1 affecting the Compiler component. It allows an unauthenticated attacker to remotely compromise the system via HTTP, potentially leading to a full takeover of Oracle GraalVM. The vulnerability has a high CVSS score of 8.1 due to its impact on confidentiality, integrity, and availability.

Detection Guidance

Detection of CVE-2026-87288 requires checking for vulnerable Oracle GraalVM versions. Verify installed versions with commands like 'graalvm --version' or 'java -version'. Ensure no instances of Oracle GraalVM 25.0.4.1 are running. Monitor network traffic for unusual HTTP requests targeting GraalVM services.

Impact Analysis

If exploited, this vulnerability could allow an attacker to take over your Oracle GraalVM instance, leading to unauthorized access, data breaches, or system manipulation. This could disrupt services relying on GraalVM and compromise sensitive data processed by the system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using Oracle GraalVM must address this to avoid potential legal and regulatory penalties.

Mitigation Strategies

Update Oracle GraalVM to a version that is not affected by this vulnerability. Monitor Oracle's security advisories for patches and apply them promptly. Restrict network access to Oracle GraalVM instances to trusted sources only.

Hi! I’m here to help you understand CVE-2026-87288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70