CVE-2026-87287

Oracle GraalVM 25.0.4.1 (part of Oracle Java SE) contains a vulnerability in its Compiler component that allows an unauthenticated remote attacker with network access via HTTP to compromise the GraalVM installation. Oracle rates the vulnerability as difficult to exploit (Attack Complexity: High), but a successful attack can result in a complete takeover of GraalVM with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). Only the specific version Oracle GraalVM 25.0.4.1 is listed as affected. There is no known public proof-of-concept, the flaw is not on the CISA Known Exploited Vulnerabilities catalog, and no exploitation in the wild has been reported. Because exploitation depends on HTTP-reachable GraalVM runtimes, deployments that do not expose GraalVM-based services to untrusted networks are at substantially lower risk.

What to do: Upgrade Oracle GraalVM from 25.0.4.1 to the fixed release provided in Oracle's latest Critical Patch Update, since only that version is listed as affected. Restrict HTTP/network access to GraalVM-based services so they are not reachable by untrusted clients, which also mitigates the high attack-complexity exploitation path. Audit logs on GraalVM 25.0.4.1 hosts for unexplained process or compiler activity until the upgrade is complete.