CVE-2026-83357 Overview
CVE-2026-83357 is a high-severity vulnerability in the Compiler component of Oracle GraalVM for JDK and Oracle GraalVM. The flaw affects Oracle GraalVM for JDK 17 (23.0.13.1), Oracle GraalVM for JDK 21 (23.1.12.1), and Oracle GraalVM 25.0.4.1. An unauthenticated attacker with network access via HTTP can exploit the issue to compromise the affected runtime. Successful exploitation results in full takeover of the GraalVM instance, impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-22 (Path Traversal). Oracle disclosed the issue in the Oracle Security Alert September 2026.
Critical Impact
Remote, unauthenticated exploitation over HTTP can result in complete takeover of Oracle GraalVM for JDK and Oracle GraalVM runtimes, exposing hosted Java workloads to code execution and data compromise.
Affected Products
- Oracle GraalVM for JDK 17: 23.0.13.1
- Oracle GraalVM for JDK 21: 23.1.12.1
- Oracle GraalVM: 25.0.4.1
Discovery Timeline
- 2026-09-15 - CVE CVE-2026-83357 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-83357
Vulnerability Analysis
The vulnerability resides in the Compiler component of Oracle GraalVM for JDK and Oracle GraalVM. Oracle categorizes it as difficult to exploit, requiring specific conditions along the network path. Once those conditions are met, the attacker does not need credentials or user interaction to reach the vulnerable code. Successful exploitation grants control over the GraalVM process, which typically executes Java workloads with application-level privileges. Because GraalVM commonly runs polyglot and native-image workloads in production, compromise can extend to any application code, secrets, or data hosted in the runtime.
Root Cause
The issue is tracked under CWE-22, Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). This weakness occurs when input used to construct file paths is not properly canonicalized or restricted, allowing references such as ../ to escape an intended directory. In the context of the GraalVM Compiler component, unsanitized path handling can enable an attacker to read or write files outside the expected scope, leading to component takeover. Oracle has not published lower-level technical details beyond the advisory.
Attack Vector
The attack vector is network-based over HTTP. An unauthenticated remote attacker sends crafted requests to a service that exposes the vulnerable GraalVM compiler functionality. No user interaction is required. Exploitation complexity is high, indicating the attacker must satisfy timing, configuration, or environmental preconditions to reliably trigger the flaw. Refer to the Oracle Security Alert September 2026 for vendor guidance. No public proof-of-concept or exploit code has been observed at publication.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-83357
Indicators of Compromise
- HTTP requests to GraalVM-hosted endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes.
- Unexpected file creation, modification, or reads outside the GraalVM application working directory.
- New child processes spawned by the java or native-image runtime that do not match baseline application behavior.
- Outbound network connections from GraalVM hosts to previously unseen infrastructure following anomalous HTTP traffic.
Detection Strategies
- Inventory hosts running Oracle GraalVM for JDK 17 23.0.13.1, JDK 21 23.1.12.1, or Oracle GraalVM 25.0.4.1 and prioritize monitoring on those systems.
- Deploy web application firewall or reverse proxy rules that block path traversal patterns targeting GraalVM-fronted services.
- Correlate authentication-less HTTP requests with subsequent file system or process anomalies on the same host.
Monitoring Recommendations
- Enable verbose HTTP access logging on services fronted by GraalVM and forward logs to a central analytics platform.
- Baseline normal file access patterns for GraalVM workloads and alert on deviations, particularly writes to system directories.
- Monitor for unexpected changes to GraalVM installation paths, class files, and native-image binaries.
How to Mitigate CVE-2026-83357
Immediate Actions Required
- Apply the fixes referenced in the Oracle Security Alert September 2026 to all affected GraalVM instances.
- Restrict network exposure of GraalVM-hosted HTTP services to trusted segments until patches are deployed.
- Audit GraalVM hosts for signs of prior exploitation, including anomalous file system activity and new outbound connections.
Patch Information
Oracle addressed CVE-2026-83357 in the September 2026 Security Alert. Administrators should upgrade Oracle GraalVM for JDK 17, Oracle GraalVM for JDK 21, and Oracle GraalVM to the versions specified in the Oracle Security Alert September 2026. Apply patches to development, staging, and production environments, and rebuild any native images produced with vulnerable GraalVM versions.
Workarounds
- Place GraalVM-hosted HTTP endpoints behind a web application firewall configured to block path traversal payloads.
- Enforce strict input validation and canonicalization in application code that accepts file paths or resource identifiers.
- Run GraalVM workloads under least-privilege service accounts with restricted file system and network permissions.
- Isolate GraalVM instances in dedicated containers or virtual machines to limit lateral movement if takeover occurs.
# Configuration example
# Verify installed GraalVM version and plan upgrade
java -version
native-image --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
