CVE-2026-87288: Oracle GraalVM Compiler RCE Vulnerability

CVE-2026-87288 Overview

CVE-2026-87288 is a high-severity vulnerability in the Oracle GraalVM product of Oracle Java SE, specifically within the Compiler component. The flaw affects Oracle GraalVM version 25.0.4.1 and allows an unauthenticated remote attacker to compromise the runtime via HTTP-based interactions. Successful exploitation can lead to full takeover of the GraalVM instance, impacting confidentiality, integrity, and availability. The weakness is classified under CWE-284: Improper Access Control. Exploitation requires overcoming meaningful attack complexity, but no user interaction or prior authentication is needed.

Critical Impact
Unauthenticated attackers with network access via HTTP can achieve complete takeover of vulnerable Oracle GraalVM 25.0.4.1 instances, compromising all hosted Java workloads.

Affected Products

Oracle GraalVM 25.0.4.1 (Compiler component)
Oracle Java SE deployments packaging the affected GraalVM release
Applications and services running on the vulnerable GraalVM runtime

Discovery Timeline

2026-09-15 - CVE-2026-87288 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87288

Vulnerability Analysis

The vulnerability resides in the Compiler component of Oracle GraalVM 25.0.4.1. GraalVM's Compiler translates bytecode and other guest-language input into optimized native code at runtime. A flaw in access-control enforcement within this pipeline enables a remote actor to reach compiler functionality that should be restricted. Because the attack traverses HTTP and requires no credentials, exposure of GraalVM-backed services to untrusted networks materially raises risk. The complexity component reflects specific conditions the attacker must satisfy, such as timing, configuration state, or input shape, before compromise succeeds.

Root Cause

The root cause maps to CWE-284: Improper Access Control. The Compiler component does not adequately restrict which callers can trigger sensitive compilation or runtime operations. When an unauthenticated request reaches a code path that assumes trusted invocation, the boundary between untrusted input and privileged compiler behavior collapses, opening a path to arbitrary code execution within the GraalVM process.

Attack Vector

Exploitation occurs over the network using HTTP. An attacker sends crafted requests to a service running on top of vulnerable GraalVM 25.0.4.1. No credentials or user interaction are required. Successful chains result in takeover of the GraalVM runtime, giving the attacker the ability to execute code, read sensitive data, tamper with in-flight logic, and disrupt availability of hosted Java applications. Refer to the Oracle Security Alert on Open Source CVEs for vendor-supplied technical detail.

Detection Methods for CVE-2026-87288

Indicators of Compromise

Unexpected outbound network connections initiated by GraalVM-hosted Java processes to unfamiliar destinations.
New or modified files under GraalVM installation directories, particularly under compiler cache paths.
Anomalous spikes in CPU or memory consumption tied to just-in-time compilation activity.
HTTP requests to application endpoints containing unusual serialized payloads, class references, or reflection-style parameters.

Detection Strategies

Inventory all Oracle GraalVM deployments and confirm whether version 25.0.4.1 is present.
Inspect application logs for HTTP requests that trigger unusual compilation, class loading, or reflection behavior.
Correlate process telemetry from GraalVM JVMs with network events to identify child-process creation or unexpected shell invocation.
Alert on new listening sockets or scheduled tasks originating from Java runtime processes.

Monitoring Recommendations

Enable verbose audit logging on GraalVM-backed services and forward events to a centralized analytics platform.
Baseline normal compiler and class-loading activity, then alert on statistical deviations.
Monitor egress traffic from application servers hosting GraalVM for connections to non-approved destinations.
Track integrity of GraalVM binaries and configuration files with file-integrity monitoring.

How to Mitigate CVE-2026-87288

Immediate Actions Required

Identify every host running Oracle GraalVM 25.0.4.1 and prioritize those exposed to untrusted HTTP traffic.
Restrict inbound HTTP access to GraalVM-hosted services using network segmentation, firewall policy, or a web application firewall.
Apply Oracle-supplied fixes referenced in the Oracle Security Alert on Open Source CVEs as soon as available.
Rotate credentials, tokens, and keys accessible to any GraalVM instance suspected of exposure.

Patch Information

Oracle publishes remediation guidance through the Oracle Security Alert on Open Source CVEs page. Administrators should upgrade Oracle GraalVM 25.0.4.1 to the fixed release identified in that advisory and validate that dependent Java SE distributions pull in the patched compiler component. Restart affected services after patching to ensure the vulnerable code is unloaded.

Workarounds

Place vulnerable GraalVM services behind an authenticating reverse proxy that filters unexpected HTTP methods and payload shapes.
Disable or restrict application features that expose compiler, scripting, or reflection functionality to untrusted input.
Enforce least-privilege operating-system accounts for GraalVM processes to limit blast radius after compromise.
Where feasible, roll back to a prior GraalVM release that is not affected by this issue until Oracle patches are applied.

bash

# Configuration example: restrict inbound HTTP access to GraalVM services
# Example iptables rule allowing only trusted management subnet
iptables -A INPUT -p tcp --dport 8080 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Verify installed GraalVM version
$JAVA_HOME/bin/java -version