CVE-2026-87287 Overview
CVE-2026-87287 is a network-exploitable vulnerability in the Compiler component of Oracle GraalVM, part of Oracle Java SE. The flaw affects Oracle GraalVM version 25.0.4.1 and allows an unauthenticated attacker with HTTP network access to compromise the affected instance. Successful exploitation results in full takeover of the GraalVM runtime, impacting confidentiality, integrity, and availability. Oracle classifies exploitation as difficult, but the impact scope covers the entire compiler subsystem. The weakness is categorized under CWE-284 (Improper Access Control).
Critical Impact
Unauthenticated network attackers can achieve complete takeover of Oracle GraalVM instances running the affected release.
Affected Products
- Oracle GraalVM 25.0.4.1
- Oracle Java SE (Compiler component)
- Applications embedding the affected GraalVM runtime
Discovery Timeline
- 2026-09-15 - CVE-2026-87287 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-87287
Vulnerability Analysis
The vulnerability resides in the Compiler component of Oracle GraalVM 25.0.4.1. An unauthenticated attacker can reach the affected code path over HTTP without user interaction. Oracle describes exploitation as difficult, indicating the attacker must satisfy conditions outside their direct control, such as specific runtime state or timing. When those conditions are met, the attacker gains full control of the GraalVM process. The impact affects confidentiality, integrity, and availability of the runtime and any workloads it executes.
GraalVM's compiler processes untrusted input paths in polyglot and JIT scenarios. A weakness in access control at that boundary allows an attacker to reach privileged compiler operations that should be restricted. See the Oracle Security Alert: Open Source CVEs for vendor context.
Root Cause
The issue maps to CWE-284, Improper Access Control. The Compiler component fails to enforce required authorization checks on a network-reachable code path, permitting an unauthenticated caller to invoke functionality that should require validated context.
Attack Vector
An attacker sends crafted HTTP traffic to a service backed by the vulnerable GraalVM runtime. No credentials or user interaction are required. Because exploitation is rated as high complexity, the attacker likely needs to influence server-side compiler state or trigger a specific execution path before the access control gap can be abused for takeover.
No verified public proof-of-concept code is available. Refer to the Oracle Security Alert for technical details when Oracle publishes them.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-87287
Indicators of Compromise
- Unexpected child processes or shell invocations spawned by GraalVM (java, native-image, graalvm) processes.
- Outbound connections from GraalVM hosts to unfamiliar destinations following inbound HTTP requests.
- Anomalous compilation errors, JIT recompilation loops, or crashes in GraalVM logs correlated with external requests.
Detection Strategies
- Inventory hosts and containers running Oracle GraalVM 25.0.4.1 and inspect exposure of HTTP endpoints backed by the runtime.
- Alert on GraalVM processes writing to sensitive filesystem paths or loading unexpected native libraries.
- Correlate web application firewall (WAF) logs with GraalVM process behavior to identify HTTP requests that precede anomalous activity.
Monitoring Recommendations
- Enable verbose logging for the GraalVM Compiler component and forward logs to a centralized SIEM for correlation.
- Baseline normal HTTP request patterns to GraalVM-hosted services and alert on deviations in payload size, method, or headers.
- Monitor for privilege changes, new user accounts, or scheduled task creation on hosts running GraalVM.
How to Mitigate CVE-2026-87287
Immediate Actions Required
- Identify all Oracle GraalVM 25.0.4.1 deployments across production, staging, and development environments.
- Restrict network access to GraalVM-backed HTTP endpoints using network segmentation, firewall rules, or reverse proxy allowlists.
- Apply Oracle's fixed release as soon as it is published in the Oracle Security Alert: Open Source CVEs advisory.
Patch Information
Oracle tracks this issue through its Open Source CVEs advisory. Consult the Oracle Security Alert: Open Source CVEs for the fixed version and upgrade guidance. Organizations should schedule upgrades from Oracle GraalVM 25.0.4.1 to the next patched release once available.
Workarounds
- Place GraalVM-backed services behind a WAF configured to inspect and rate-limit HTTP traffic.
- Run GraalVM processes under least-privilege service accounts inside hardened containers to constrain post-exploitation impact.
- Disable or isolate non-essential polyglot and dynamic compilation features where the application does not require them.
# Configuration example: restrict inbound HTTP to GraalVM service via iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
# Verify installed GraalVM version
java -version
native-image --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
