CVE-2026-83368: Oracle GraalVM Auth Bypass Vulnerability

CVE-2026-83368 Overview

CVE-2026-83368 is a high-severity vulnerability in the Compiler component of Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, and Oracle GraalVM. An unauthenticated attacker with network access via HTTP can compromise affected installations without user interaction. Successful exploitation grants unauthorized access to critical data, unauthorized modification of some data, and a partial denial of service condition. Oracle classifies the flaw under CWE-284: Improper Access Control. While exploitation is rated as difficult, the confidentiality impact reaches complete access to all GraalVM-accessible data. Oracle disclosed the issue in the Oracle Security Alert CSPUSEP2026.

Critical Impact
Unauthenticated network attackers can obtain complete access to GraalVM-accessible data and cause partial denial of service across affected Oracle GraalVM installations.

Affected Products

Oracle GraalVM for JDK 17: 23.0.13.1
Oracle GraalVM for JDK 21: 23.1.12.1
Oracle GraalVM Enterprise Edition: 21.3.19.1 and Oracle GraalVM: 25.0.4.1

Discovery Timeline

2026-09-15 - CVE-2026-83368 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83368

Vulnerability Analysis

The vulnerability resides in the Compiler component of Oracle GraalVM. GraalVM is a polyglot runtime and just-in-time compiler used to execute Java and other language workloads. The flaw allows a remote attacker to reach the compiler layer through HTTP-exposed services that leverage GraalVM. Once triggered, the attacker gains read access to data managed by the runtime, limited write capabilities, and can induce partial service disruption. Because the attack requires no authentication and no user interaction, any GraalVM-backed HTTP endpoint reachable from an untrusted network is exposed.

Root Cause

The underlying weakness maps to [CWE-284: Improper Access Control]. Access decisions inside the Compiler component do not adequately restrict operations available to unauthenticated callers. This gap enables an attacker to reach sensitive runtime state or issue operations that should require elevated privilege. Oracle marks exploitation complexity as high, indicating specific runtime conditions or timing must align for successful abuse.

Attack Vector

The attack vector is network-based over HTTP. The scope remains unchanged, meaning the impact is contained within the vulnerable component's security authority. However, the confidentiality impact is rated high because a successful attacker obtains complete access to all data accessible to the GraalVM instance. Integrity and availability impacts are limited to partial modification and partial denial of service.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied technical detail.

Detection Methods for CVE-2026-83368

Indicators of Compromise

Anomalous HTTP requests targeting GraalVM-hosted services with unusual payloads directed at compiler or runtime endpoints.
Unexpected outbound network activity or data egress from hosts running affected GraalVM versions.
Elevated CPU or memory usage in GraalVM processes correlated with partial service degradation.

Detection Strategies

Inventory all Java workloads and identify installations of Oracle GraalVM for JDK 17, JDK 21, Enterprise Edition, or GraalVM 25 at the affected patch levels.
Deploy web application firewall rules to inspect HTTP traffic reaching GraalVM-fronted services for malformed or unexpected compiler-directed input.
Correlate runtime crash logs, JVM error dumps, and HTTP access logs to identify repeated failure patterns tied to compiler invocation.

Monitoring Recommendations

Enable verbose logging on GraalVM runtime and compiler subsystems and forward logs to a centralized SIEM for baselining and anomaly detection.
Monitor for unauthorized configuration changes, unexpected process spawning, and file system modifications on hosts running GraalVM.
Track network flow telemetry to detect scanning or repeated probing against HTTP endpoints backed by affected GraalVM versions.

How to Mitigate CVE-2026-83368

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 to all affected GraalVM installations.
Restrict network exposure of GraalVM-hosted HTTP services to trusted networks and enforce authentication at upstream proxies where feasible.
Audit application dependencies and container images for the affected versions and prioritize remediation for internet-facing workloads.

Patch Information

Oracle addressed CVE-2026-83368 in the security alert CSPUSEP2026. Upgrade Oracle GraalVM for JDK 17 beyond version 23.0.13.1, Oracle GraalVM for JDK 21 beyond 23.1.12.1, Oracle GraalVM Enterprise Edition beyond 21.3.19.1, and Oracle GraalVM beyond 25.0.4.1 using the fixed builds provided by Oracle. Consult the Oracle Security Alert CSPUSEP2026 for the specific fixed version identifiers.

Workarounds

Place affected GraalVM services behind an authenticating reverse proxy and drop unauthenticated HTTP requests at the network boundary.
Segment GraalVM workloads into isolated network zones with strict egress filtering to limit data exposure if exploitation occurs.
Disable or remove GraalVM-hosted HTTP endpoints that are not required for business operations until patches are applied.

bash

# Verify installed GraalVM version to identify affected hosts
java -version
# Example output should be compared against fixed versions from Oracle CSPUSEP2026
# Upgrade using your distribution's package manager or Oracle-provided installer