Description
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A flaw in Oracle GraalVM for JDK and Oracle GraalVM allows an unauthenticated attacker with network access via HTTP to compromise the JVM. The vulnerability is first‑party, and the affected component is the compiler. Successful exploitation can lead to a full takeover of the affected GraalVM instance, impacting confidentiality, integrity, and availability as reflected by the CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness involves improper access control of HTTP services, which would permit remote code execution.

Affected Systems

The affected products are Oracle GraalVM for JDK version 23.0.13.1 (Java 17) and 23.1.12.1 (Java 21) as well as Oracle GraalVM version 25.0.4.1. These versions are distributed under the Oracle GraalVM product line.

Risk and Exploitability

The CVSS score of 8.1 places this flaw in the high‑severity category. The EPSS score is below 1 %, indicating a low probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. The attack vector is remote over HTTP, requires no authentication or user interaction, and involves high effort to exploit as indicated by the high attack complexity rating.

Generated by OpenCVE AI on September 16, 2026 at 22:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest patched release of Oracle GraalVM for JDK and Oracle GraalVM, or this issue.
  • Restrict network access to the GraalVM HTTP endpoint by configuring firewall rules or placing the service behind a not possible, disable or delete any unmanaged HTTP interfaces and ensure that management endpoints.
  • If no patch is available, block unauthenticated HTTP access and log all HTTP requests for anomaly detection.

Generated by OpenCVE AI on September 16, 2026 at 22:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unauthenticated HTTP Access in Oracle GraalVM for JDK and Oracle GraalVM

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-94
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle graalvm
Oracle graalvm For Jdk
CPEs cpe:2.3:a:oracle:graalvm:25.0.4.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:23.0.13.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:graalvm_for_jdk:23.1.12.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle graalvm
Oracle graalvm For Jdk
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Graalvm Graalvm For Jdk
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T19:19:33.589Z

Reserved: 2026-08-31T15:40:57.357Z

Link: CVE-2026-83408

cve-icon Vulnrichment

Updated: 2026-09-16T19:19:29.285Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T22:17:03.807

Modified: 2026-09-16T20:17:34.037

Link: CVE-2026-83408

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-16T23:00:09Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')