Description
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data as well as unauthorized update, insert or delete access to some of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).
Published: 2026-09-15
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access and partial denial of service
Action: Patch Now
AI Analysis

Impact

A security flaw in the Oracle GraalVM compiler component allows an unauthenticated attacker who can reach the system over HTTP to gain unauthorized access to sensitive data and perform limited write operations. The impact includes the possibility of partial denial of service, as well as the ability to read, modify, or delete data within the GraalVM ecosystem. The vulnerability is rated moderate, with significant confidentiality impact but lower integrity and availability effects as reflected in its CVSS vector.

Affected Systems

Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, and Oracle Graal are 23.0.13.1 for GraalVM for JDK on JDK 17, 23.1.12.1 for GraalVM for JDK on JDK 21, 21.3.19.1 for Oracle GraalVM Enterprise Edition, and 25.0.4.1 for the standard Oracle GraalVM. Proprietary GraalVM products that include the same compiler component are also at risk.

Risk and Exploitability

The CVSS score of 7.0 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. Because the vulnerability is accessible via standard HTTP and requires no authentication, it remains a significant threat if an attacker can over the network, even though it is not yet included in CISA’s KEV catalog.

Generated by OpenCVE AI on September 16, 2026 at 20:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, and Oracle GraalVM to the latest patched releases that incorporate the Oracle security fix.
  • If an upgrade cannot be performed immediately, block or restrict HTTP traffic to the GraalVM management interface using firewall or network segmentation to prevent unauthenticated external access.
  • Apply any vendor‑released hardening guidelines and review the GraalVM configuration to disable unused compiler features or services.

Generated by OpenCVE AI on September 16, 2026 at 20:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Title Remote Unauthorized Data Access and Partial Denial of Service in Oracle GraalVM via Compiler Exploit
Weaknesses CWE-200

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data as well as unauthorized update, insert or delete access to some of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:23.0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:23.1.12.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L'}

Subscriptions

Oracle Graalvm Graalvm For Jdk
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T19:22:10.852Z

Reserved: 2026-08-31T15:40:57.355Z

Link: CVE-2026-83368

cve-icon Vulnrichment

Updated: 2026-09-16T19:20:11.795Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T22:17:03.670

Modified: 2026-09-16T20:17:33.533

Link: CVE-2026-83368

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T20:45:05Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control