Vulnerability in Oracle GraalVM for JDK Affects Java SE Compiler
CVE-2026-83357

8.1HIGH

Key Information:

Vendor

Oracle
Status
Oracle Graalvm For Jdk, Oracle Graalvm
Vendor
CVE Published:
15 September 2026

What is CVE-2026-83357?

A security vulnerability in Oracle GraalVM for JDK allows unauthenticated attackers with network access via HTTP to compromise the product. This issue specifically affects multiple versions of GraalVM, including 17, 21, and the standalone GraalVM. Exploitation of this vulnerability could enable an attacker to take control of the affected Oracle GraalVM components, potentially leading to significant breaches in confidentiality, integrity, and availability of systems relying on this technology.

Affected Version(s)

Oracle GraalVM for JDK, Oracle GraalVM Oracle GraalVM for JDK 17:23.0.13.1

Oracle GraalVM for JDK, Oracle GraalVM Oracle GraalVM for JDK 21:23.1.12.1

Oracle GraalVM for JDK, Oracle GraalVM Oracle GraalVM:25.0.4.1

References

https://www.oracle.com/security-alerts/cspusep2026.html
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.