Description
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

The vulnerability arises from a Path Traversal flaw (CWE-22) in the Oracle GraalVM compiler component, allowing an unauthenticated attacker who can reach the service over HTTP to gain full control of the GraalVM instance. This flaw can lead to the compromise of confidentiality, integrity, and availability, as reflected in the CVSS base score of 8.1.

Affected Systems

Oracle GraalVM for JDK 23.0.13.1 for Java 17, Oracle GraalVM for JDK 23.1.12.1 for Java 21, and the generic Oracle GraalVM 25.0.4.1 build are affected.

Risk and Exploitability

The EPSS score is less than 1 percent, indicating low current exploit activity, and the vulnerability is not listed in the CISA KEV catalog. Despite the low EPSS, the high CVSS score and the fact that no authentication or privilege is required mean that any host with network access to the GraalVM HTTP endpoint could exploit the flaw to achieve remote code execution.

Generated by OpenCVE AI on September 16, 2026 at 22:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a GraalVM version newer than 23.0.13.1 (Java 17), 23.1.12.1 (Java 21), or 25.0.4.1.
  • Restrict network access to the GraalVM HTTP interface through firewall rules or VPN so that only trusted hosts can reach the service.
  • Disable or remove the compiler HTTP endpoint if the deployment does not require it, thereby preventing external interaction with the vulnerable component.

Generated by OpenCVE AI on September 16, 2026 at 22:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack Enables Full Oracle GraalVM Compromise

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
CPEs cpe:2.3:a:oracle:graalvm:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:23.0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:23.1.12.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Graalvm Graalvm For Jdk
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T19:18:02.991Z

Reserved: 2026-08-31T15:40:57.354Z

Link: CVE-2026-83357

cve-icon Vulnrichment

Updated: 2026-09-16T19:15:05.979Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T22:17:03.543

Modified: 2026-09-16T20:17:33.023

Link: CVE-2026-83357

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T06:00:08Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')