CVE-2026-87286 is a vulnerability in the Oracle GraalVM Compiler component of Oracle Java SE, affecting version 25.0.4.1. It allows an unauthenticated remote attacker with HTTP network access to compromise the product, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 8.1, with high impact on confidentiality, integrity, and availability. The attack complexity is high, and no privileges or user interaction are required for exploitation. No known exploits in the wild have been reported. The Oracle advisory references a merged page for open source CVEs but does not provide explicit patch or remediation details.

Successful exploitation can lead to complete compromise of Oracle GraalVM, impacting confidentiality, integrity, and availability of the system. The vulnerability is remotely exploitable without authentication but is difficult to exploit due to high attack complexity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Oracle advisory for current remediation guidance. The vendor advisory does not explicitly state if a fix is available or if any temporary mitigations exist. Users should monitor Oracle's official security alerts for updates and apply patches once released.