This vulnerability affects the Compiler component of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, and Oracle GraalVM. It allows an unauthenticated attacker with network access via HTTP to compromise the affected products. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 base score is 7.0, indicating high severity, with attack vector network, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality (high), integrity (low), and availability (low). The affected versions explicitly stated are Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM Enterprise Edition version 21.3.19.1, and Oracle GraalVM version 25.0.4.1. Oracle has released this fix as part of its September 2026 Critical Security Patch Update.

The vulnerability allows unauthorized attackers to gain unauthorized access to critical data or full access to all accessible data in the affected Oracle GraalVM products. It also permits unauthorized data modification operations (update, insert, delete) on some data and can cause a partial denial of service. The impact affects confidentiality significantly, with lower impacts on integrity and availability.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches without delay to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and promptly applying security patches. No additional mitigation steps are specified beyond applying the official patch.