CVE-2026-87287: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM. in Oracle Corporation Oracle GraalVM
CVE-2026-87287 is a high-severity vulnerability in Oracle GraalVM version 25.0.4.1. It allows an unauthenticated attacker with network access via HTTP to potentially take over the Oracle GraalVM instance. The vulnerability is difficult to exploit but impacts confidentiality, integrity, and availability. No known exploits are reported in the wild. Oracle has not provided a specific patch or detailed remediation guidance in the referenced advisory.
AI Analysis
Technical Summary
This vulnerability affects the Oracle GraalVM product, specifically version 25.0.4.1. It is a network-accessible flaw that requires no authentication but has a high attack complexity, making exploitation difficult. Successful exploitation can lead to full compromise of the Oracle GraalVM environment, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1, reflecting the severity of the impact. Oracle's public advisory references this CVE but does not provide explicit patch or mitigation details, indicating that the vulnerability is recognized but remediation status is not confirmed in the available data.
Potential Impact
An unauthenticated attacker with network access via HTTP could exploit this vulnerability to take over the Oracle GraalVM instance, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This could allow unauthorized access, data manipulation, or service disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/oracle-open-source-cves-outside-other-oracle-public-documents.html for current remediation guidance. Until a patch or official fix is available, restrict network access to Oracle GraalVM instances and monitor for unusual activity as a precaution.
CVE-2026-87287: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM. in Oracle Corporation Oracle GraalVM
Description
CVE-2026-87287 is a high-severity vulnerability in Oracle GraalVM version 25.0.4.1. It allows an unauthenticated attacker with network access via HTTP to potentially take over the Oracle GraalVM instance. The vulnerability is difficult to exploit but impacts confidentiality, integrity, and availability. No known exploits are reported in the wild. Oracle has not provided a specific patch or detailed remediation guidance in the referenced advisory.
CVSS v3.1
Score 8.1high
Affected software
Oracle Corporation
Oracle GraalVM
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the Oracle GraalVM product, specifically version 25.0.4.1. It is a network-accessible flaw that requires no authentication but has a high attack complexity, making exploitation difficult. Successful exploitation can lead to full compromise of the Oracle GraalVM environment, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1, reflecting the severity of the impact. Oracle's public advisory references this CVE but does not provide explicit patch or mitigation details, indicating that the vulnerability is recognized but remediation status is not confirmed in the available data.
Potential Impact
An unauthenticated attacker with network access via HTTP could exploit this vulnerability to take over the Oracle GraalVM instance, resulting in complete compromise of confidentiality, integrity, and availability of the affected system. This could allow unauthorized access, data manipulation, or service disruption.
Mitigation Recommendations
Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/oracle-open-source-cves-outside-other-oracle-public-documents.html for current remediation guidance. Until a patch or official fix is available, restrict network access to Oracle GraalVM instances and monitor for unusual activity as a precaution.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-09-08T21:49:12.409Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/oracle-open-source-cves-outside-other-oracle-public-documents.html","vendor":"Oracle"}]
Threat ID: 6aa9a43e55bf5e2cf54f7f05
Added to database: 09/15/2026, 20:02:06 UTC
Last enriched: 09/15/2026, 20:16:35 UTC
Last updated: 09/15/2026, 20:16:35 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.