CVE-2026-87286

CVE-2026-87286 is a high-severity (CVSS 8.1) vulnerability in the Compiler component of Oracle GraalVM for Oracle Java SE, affecting only version 25.0.4.1. An unauthenticated remote attacker with network access via HTTP can trigger the flaw, and a successful exploit can result in a complete takeover of Oracle GraalVM, with high impacts on confidentiality, integrity, and availability. Oracle rates the vulnerability as difficult to exploit (Attack Complexity: High), meaning reliable exploitation requires specialized conditions or race-like circumstances rather than a trivial request. The exposure is limited to systems actually running the specific GraalVM 25.0.4.1 release, typically developer workstations, CI/CD build infrastructure, and applications deployed on GraalVM that serve HTTP traffic. No public proof of concept is known, the flaw is not on the CISA Known Exploited Vulnerabilities list, and there are no reports of in-the-wild exploitation at this time.

What to do: Upgrade Oracle GraalVM from 25.0.4.1 to the fixed release provided in Oracle's Critical Patch Update covering this CVE. Audit build pipelines, developer environments, and production services for any system reporting GraalVM 25.0.4.1, and restrict network/HTTP reachability to GraalVM-based services until patched. Monitor Oracle's advisory for the fixed version number and any updated exploitation guidance.