CVE-2026-83408 is a vulnerability in the compiler component of Oracle GraalVM for JDK, specifically affecting Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM version 25.0.4.1. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 score of 8.1 with high confidentiality, integrity, and availability impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete compromise of Oracle GraalVM for JDK, impacting confidentiality, integrity, and availability of the system. The vulnerability can be exploited remotely without authentication but requires network access via HTTP. The high CVSS score reflects the critical nature of the impact.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. Customers should apply the official patch promptly to mitigate the risk. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated by the vendor advisory.