This vulnerability affects the Compiler component of Oracle GraalVM for JDK and Oracle GraalVM. It is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, and no user interaction needed, impacting confidentiality, integrity, and availability at a high level. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products, including Oracle GraalVM for JDK versions 23.0.13.1 (JDK 17), 23.1.12.1 (JDK 21), and Oracle GraalVM 25.0.4.1. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle GraalVM for JDK and Oracle GraalVM, affecting confidentiality, integrity, and availability. This means an attacker could potentially execute arbitrary code, access sensitive data, and disrupt service.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for their affected Oracle GraalVM versions immediately. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.