CVE-2026-87288: High severity Oracle GraalVM vulnerability

Published Sep 15, 2026

Updated

Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Software

1 affected component

Oracle GraalVM=25.0.4.1

Event History

Sep 15, 2026

CVE Published

via MITRE·07:56 PM

Data Sourced

via MITRE·07:56 PM

DescriptionSeverity

Data Sourced

via NVD·08:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An unauthenticated attacker with network access via HTTP can attempt exploitation. No user interaction or prior privileges are required, although exploitation is rated difficult.

What is the potential impact of successful exploitation?

Successful exploitation can result in takeover of Oracle GraalVM, with high confidentiality, integrity, and availability impact.

Which version is identified as affected?

The affected supported version identified is Oracle GraalVM 25.0.4.1.