CVE-2026-83368: High severity Oracle Oracle GraalVM for JDK 17 vulnerability

Published Sep 15, 2026

Updated

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data as well as unauthorized update, insert or delete access to some of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).

Affected Software

4 affected components

Oracle Oracle GraalVM for JDK 17=23.0.13.1

Oracle Oracle GraalVM for JDK 21=23.1.12.1

Oracle Oracle GraalVM Enterprise Edition=21.3.19.1

Oracle Oracle GraalVM=25.0.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Oracle GraalVM for JDK 17 to a version that resolves this vulnerability.
Fixed in 23.0.13.1
Upgrade
Upgrade Oracle GraalVM for JDK 21 to a version that resolves this vulnerability.
Fixed in 23.1.12.1
Upgrade
Upgrade Oracle GraalVM Enterprise Edition to a version that resolves this vulnerability.
Fixed in 21.3.19.1
Upgrade
Upgrade Oracle GraalVM to a version that resolves this vulnerability.
Fixed in 25.0.4.1

Event History

Sep 15, 2026

CVE Published

via MITRE·09:53 PM

Data Sourced

via MITRE·09:53 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to network-based exploitation?

Deployments of the affected Oracle GraalVM products that are reachable by an unauthenticated attacker over HTTP are exposed. The vulnerability has no privilege or user-interaction requirement, but exploitation is rated difficult.

What versions are identified as affected?

The affected supported versions are Oracle GraalVM for JDK 17 23.0.13.1, Oracle GraalVM for JDK 21 23.1.12.1, Oracle GraalVM Enterprise Edition 21.3.19.1, and Oracle GraalVM 25.0.4.1.

What could a successful attacker do?

A successful attack can provide unauthorized access to critical data or complete access to accessible data. It can also allow unauthorized update, insert, or delete operations on some accessible data and cause a partial denial of service.