Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVE-2026-87288)
A high-severity vulnerability (CVE-2026-87288) exists in the Oracle GraalVM component of Oracle Java SE, specifically in the Compiler. The vulnerability affects Oracle GraalVM version 25.0.4.1 and allows an unauthenticated attacker with network access via HTTP to potentially take over the Oracle GraalVM instance. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. The vulnerability is difficult to exploit and no known exploits are reported in the wild. Oracle has merged the advisory into a general CVE listing and no explicit patch or remediation details are provided in the vendor advisory.
AI Analysis
Technical Summary
CVE-2026-87288 is a vulnerability in the Oracle GraalVM product of Oracle Java SE, specifically in the Compiler component. The affected version is Oracle GraalVM 25.0.4.1. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially leading to full takeover of Oracle GraalVM. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory references Oracle's general CVE page without specific patch or mitigation details.
Potential Impact
Successful exploitation can lead to complete compromise of Oracle GraalVM, affecting confidentiality, integrity, and availability of the system. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1. However, exploitation is described as difficult and no known exploits are currently reported in the wild.
Mitigation Recommendations
The vendor advisory does not provide explicit patch or remediation details and merges this CVE into a general Oracle CVE listing. Patch status is not yet confirmed — check the Oracle advisory page for current remediation guidance. Until official fixes or mitigations are published, limit network exposure of Oracle GraalVM instances and monitor Oracle security alerts for updates.
Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVE-2026-87288)
Description
A high-severity vulnerability (CVE-2026-87288) exists in the Oracle GraalVM component of Oracle Java SE, specifically in the Compiler. The vulnerability affects Oracle GraalVM version 25.0.4.1 and allows an unauthenticated attacker with network access via HTTP to potentially take over the Oracle GraalVM instance. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high impact on confidentiality, integrity, and availability. The vulnerability is difficult to exploit and no known exploits are reported in the wild. Oracle has merged the advisory into a general CVE listing and no explicit patch or remediation details are provided in the vendor advisory.
CVSS v3.1
Score 8.1high
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-87288 is a vulnerability in the Oracle GraalVM product of Oracle Java SE, specifically in the Compiler component. The affected version is Oracle GraalVM 25.0.4.1. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially leading to full takeover of Oracle GraalVM. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory references Oracle's general CVE page without specific patch or mitigation details.
Potential Impact
Successful exploitation can lead to complete compromise of Oracle GraalVM, affecting confidentiality, integrity, and availability of the system. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1. However, exploitation is described as difficult and no known exploits are currently reported in the wild.
Mitigation Recommendations
The vendor advisory does not provide explicit patch or remediation details and merges this CVE into a general Oracle CVE listing. Patch status is not yet confirmed — check the Oracle advisory page for current remediation guidance. Until official fixes or mitigations are published, limit network exposure of Oracle GraalVM instances and monitor Oracle security alerts for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wpx5-pphw-xwr9
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-87288"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaa07d655bf5e2cf5ea2d1d
Added to database: 09/16/2026, 03:07:02 UTC
Last enriched: 09/16/2026, 03:18:05 UTC
Last updated: 09/16/2026, 05:01:23 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.