CVE-2026-87286: Oracle GraalVM Compiler RCE Vulnerability

CVE-2026-87286 Overview

CVE-2026-87286 is an access control weakness [CWE-284] in the Compiler component of Oracle GraalVM, part of Oracle Java SE. The flaw affects Oracle GraalVM version 25.0.4.1. An unauthenticated remote attacker can exploit the vulnerability over HTTP without user interaction. Successful exploitation results in full takeover of the Oracle GraalVM instance, impacting confidentiality, integrity, and availability. Oracle rates exploitation as difficult, which limits opportunistic attacks but does not eliminate targeted risk. Oracle disclosed the issue through its Open Source CVEs advisory channel.

Critical Impact

An unauthenticated network attacker can achieve complete takeover of Oracle GraalVM, gaining control over compiled workloads and runtime data.

Affected Products

• Oracle GraalVM 25.0.4.1 (Compiler component)
• Oracle Java SE distributions embedding the affected GraalVM release
• Applications and services running workloads on the affected GraalVM version

Discovery Timeline

• 2026-09-15 - CVE-2026-87286 published to the National Vulnerability Database
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87286

Vulnerability Analysis

The vulnerability resides in the Compiler component of Oracle GraalVM. Oracle classifies the weakness under [CWE-284] Improper Access Control, indicating that a security boundary is not correctly enforced. An unauthenticated attacker with network reachability to an affected service can send crafted HTTP traffic to reach the vulnerable code path. Because no privileges or user interaction are required, an exposed GraalVM workload is directly reachable from untrusted networks. A successful attack results in full compromise of the GraalVM process, giving the attacker control over compiled code, runtime data, and hosted application logic. Oracle notes the attack is difficult to execute, which typically implies non-trivial timing, environmental conditions, or specialized input construction.

Root Cause

Oracle's advisory attributes the flaw to improper access control within the GraalVM Compiler. Insufficient enforcement inside compiler-adjacent logic allows an external actor to influence operations that should be restricted to trusted callers. Oracle has not published deeper root-cause details for this open-source advisory entry.

Attack Vector

Exploitation occurs over the network using HTTP against a service that exposes the vulnerable GraalVM component. The attacker does not need credentials or user interaction. The high attack complexity indicates dependence on specific conditions outside the attacker's control, such as memory state, request timing, or optional configurations in the target deployment.

No public proof-of-concept exploit is available at publication. Refer to the Oracle Open Source CVEs Advisory for vendor guidance.

Detection Methods for CVE-2026-87286

Indicators of Compromise

• Unexpected outbound network connections originating from Java or GraalVM processes such as java, native-image, or graalvm.
• Abnormal child processes spawned by GraalVM runtimes, including shells, package managers, or reconnaissance utilities.
• Unusual modifications to GraalVM installation directories, class path resources, or on-disk compiled artifacts.
• Anomalous HTTP request patterns targeting GraalVM-hosted endpoints, particularly malformed or oversized payloads.

Detection Strategies

• Inventory all Oracle GraalVM deployments and flag any instance running version 25.0.4.1 for prioritized review.
• Correlate web application firewall logs with GraalVM process telemetry to identify request bursts preceding process anomalies.
• Baseline normal GraalVM process behavior and alert on deviations such as new listening ports, elevated privileges, or unusual syscalls.

Monitoring Recommendations

• Enable verbose HTTP access logging on services that front GraalVM workloads and retain logs for post-incident analysis.
• Monitor JVM and GraalVM audit logs for compiler errors, unexpected class loads, or reflection activity from untrusted sources.
• Alert on integrity changes to GraalVM binaries, libraries, and native image outputs using file integrity monitoring.

How to Mitigate CVE-2026-87286

Immediate Actions Required

• Identify every host running Oracle GraalVM 25.0.4.1 and prioritize remediation for internet-exposed instances.
• Restrict inbound HTTP access to GraalVM services using network segmentation, allowlists, and reverse proxies.
• Require authentication and TLS on all application endpoints backed by GraalVM to reduce unauthenticated exposure.
• Increase logging and alerting sensitivity on affected systems until patching is complete.

Patch Information

Oracle addresses this vulnerability through its security advisory program. Review the Oracle Open Source CVEs Advisory and apply the fixed GraalVM release for your distribution. Validate application compatibility with the updated runtime in a staging environment before deploying to production.

Workarounds

• Block external HTTP access to GraalVM-hosted services at the perimeter until patches are installed.
• Run GraalVM processes under least-privilege service accounts to limit the impact of a successful takeover.
• Deploy a web application firewall in front of exposed GraalVM endpoints to filter anomalous request patterns.
• Isolate GraalVM workloads in dedicated network segments with strict egress controls to contain post-exploitation movement.

# Configuration example: verify installed GraalVM version and restrict inbound HTTP
java -version
native-image --version

# Example iptables rule limiting HTTP access to a trusted management subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP