Description
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data as well as unauthorized update, insert or delete access to some of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).
Published: 2026-09-15
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data access and partial denial of service
Action: Patch Now
AI Analysis

Impact

A security flaw in the Oracle GraalVM compiler component allows an unauthenticated attacker who can reach the system over HTTP to gain unauthorized access to sensitive data and perform limited write operations. The impact includes the possibility of partial denial of service, as well as the ability to read, modify, or delete data within the GraalVM ecosystem. The vulnerability is rated moderate, with significant confidentiality impact but lower integrity and availability effects as reflected in its CVSS vector.

Affected Systems

Oracle GraalVM for JDK (JDK 17) version 23.0.13.1, Oracle GraalVM for JDK (JDK 21) version 23.1.12.1, Oracle GraalVM Enterprise Edition version 21.3.19.1, and standard Oracle GraalVM version 25.0.4.1 are all affected.

Risk and Exploitability

The CVSS score of 7.0 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. Because the vulnerability is accessible via standard HTTP and requires no authentication, it remains a significant threat if an attacker can reach the system over the network, even though it is not yet included in CISA’s KEV catalog.

Generated by OpenCVE AI on September 20, 2026 at 05:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, and Oracle GraalVM to the latest patched releases that incorporate the Oracle security fix.
  • If an upgrade cannot be performed immediately, block or restrict HTTP traffic to the GraalVM management interface using firewall or network segmentation to prevent unauthenticated external access.
  • Apply any vendor‑released hardening guidelines and review the GraalVM configuration to disable unused compiler features or services.

Generated by OpenCVE AI on September 20, 2026 at 05:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle graalvm Enterprise Edition
Vendors & Products Oracle graalvm Enterprise Edition

Fri, 18 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Title Remote Unauthorized Data Access and Partial Denial of Service in Oracle GraalVM via Compiler Exploit
Weaknesses CWE-200

Wed, 16 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Title Remote Unauthorized Data Access and Partial Denial of Service in Oracle GraalVM via Compiler Exploit
Weaknesses CWE-200

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data as well as unauthorized update, insert or delete access to some of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
CPEs cpe:2.3:a:oracle:graalvm:21.3.19.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:oracle:graalvm:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:23.0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:23.1.12.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L'}

Subscriptions

Oracle Graalvm Graalvm Enterprise Edition Graalvm For Jdk
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T19:22:10.852Z

Reserved: 2026-08-31T15:40:57.355Z

Link: CVE-2026-83368

cve-icon Vulnrichment

Updated: 2026-09-16T19:20:11.795Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T22:17:03.670

Modified: 2026-09-16T20:17:33.533

Link: CVE-2026-83368

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T02:45:11Z

Weaknesses