CVE-2026-83368

CVE-2026-83368 is a difficult-to-exploit vulnerability in the Compiler component of Oracle GraalVM, GraalVM for JDK, and GraalVM Enterprise Edition (part of Oracle Java SE). An unauthenticated attacker with network access via HTTP can trigger the flaw to compromise the affected GraalVM installation, gaining unauthorized read access to critical data or all GraalVM-accessible data, limited unauthorized update/insert/delete capability, and the ability to cause a partial denial of service. The affected versions are Oracle GraalVM for JDK 17 (23.0.13.1), GraalVM for JDK 21 (23.1.12.1), GraalVM Enterprise Edition (21.3.19.1), and GraalVM (25.0.4.1), all fixed in Oracle's corresponding Critical Patch Update. Because exploitation requires difficult conditions (CVSS 3.1 base 7.0, AV:N/AC:H/PR:N/UI:N/S:U) and GraalVM is primarily a developer toolchain and runtime rather than an internet-facing service, real-world attack surface is limited. There is no known public proof of concept and the CVE is not on the CISA Known Exploited Vulnerabilities list.

What to do: Upgrade to the Oracle GraalVM releases supplied in the current Oracle Critical Patch Update — versions later than GraalVM for JDK 17 23.0.13.1, GraalVM for JDK 21 23.1.12.1, GraalVM Enterprise Edition 21.3.19.1, and GraalVM 25.0.4.1. Inventory developer machines, CI/CD build agents, and serverless/native-image build environments for these exact versions, since they are easy to overlook outside production servers. Where patching is delayed, restrict HTTP network reachability to systems running the affected GraalVM distributions and monitor for anomalous data access.