CVE-2026-83357

CVE-2026-83357 is a difficult-to-exploit vulnerability in the Compiler component of Oracle GraalVM for JDK and Oracle GraalVM that allows an unauthenticated attacker with network access via HTTP to compromise the affected runtime. A successful attack can result in a complete takeover of Oracle GraalVM, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). The specific affected releases are Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM version 25.0.4.1, meaning applications built with or running on these exact builds are in scope. Because the attack surface requires network-reachable HTTP endpoints in applications using these GraalVM builds, exposure is limited to deployed services rather than developer workstations alone. As of this writing, the flaw is not in the CISA Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Apply Oracle's Critical Patch Update and move any GraalVM for JDK 17 (23.0.13.1), GraalVM for JDK 21 (23.1.12.1), or GraalVM 25.0.4.1 installations to the fixed successor releases for those tracks. Audit CI/CD pipelines, Docker base images, and build toolchains for these exact GraalVM versions, prioritizing services that expose HTTP endpoints to untrusted networks. Since the flaw is difficult to exploit and requires no authentication but high attack complexity, no emergency action beyond patching is indicated unless you find affected builds fronting public-facing services.