Vulnerability in Oracle GraalVM for JDK by Oracle
CVE-2026-83408

8.1HIGH

Key Information:

Vendor

Oracle
Status
Oracle Graalvm For Jdk, Oracle Graalvm
Vendor
CVE Published:
15 September 2026

What is CVE-2026-83408?

This vulnerability in Oracle GraalVM for JDK allows an unauthenticated attacker to exploit the system via HTTP. The affected versions include Oracle GraalVM for JDK 17, JDK 21, and the standalone Oracle GraalVM. Given its ease of exploitation, an attacker could potentially take control of the vulnerable environment, leading to serious security implications that affect the confidentiality, integrity, and availability of the affected systems.

Affected Version(s)

Oracle GraalVM for JDK, Oracle GraalVM Oracle GraalVM for JDK 17:23.0.13.1

Oracle GraalVM for JDK, Oracle GraalVM Oracle GraalVM for JDK 21:23.1.12.1

Oracle GraalVM for JDK, Oracle GraalVM Oracle GraalVM:25.0.4.1

References

https://www.oracle.com/security-alerts/cspusep2026.html
vendor-advisory

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.