CVE-2026-87288 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle GraalVM deployments, particularly those with version 25.0.4.1, should assess exposure and prioritize remediation. This includes verifying network access controls, reviewing and applying Oracle's security updates, and monitoring for suspicious activity. Additionally, security teams and vulnerability management teams should be aware of the potential impacts on confidentiality, integrity, and availability, and plan accordingly

Why it matters

CVE-2026-87288 in Oracle GraalVM allows unauthenticated attackers with network access to potentially take over the system. Defenders should verify exposure, restrict network access, and apply security updates.

• Potential takeover of Oracle GraalVM requires verification of network access controls
• Unauthenticated network access via HTTP increases attack surface
• Compromise could lead to confidentiality, integrity, and availability impacts

Technical summary

The vulnerability in Oracle GraalVM product of Oracle Java SE (component: Compiler) allows unauthenticated attackers with network access via HTTP to compromise Oracle GraalVM. Successful attacks can result in takeover of Oracle GraalVM. The CVSS 3.1 Base Score is 8.1 (Confidentiality, Integrity and Availability impacts). This vulnerability affects Oracle GraalVM version 25.0.4.1. Defenders should prioritize verifying exposure of this version and assessing network access controls to mitigate potential risks. The vulnerability has a high CVSS severity score, indicating a significant threat to affected systems.

Defensive priority

Defenders should prioritize verifying exposure of Oracle GraalVM version 25.0.4.1 and assessing network access controls.

Recommended defensive actions

• Verify Oracle GraalVM version 25.0.4.1 is not exposed to untrusted networks
• Assess and restrict network access to Oracle GraalVM
• Review and apply Oracle's security updates for GraalVM
• Monitor for suspicious activity related to Oracle GraalVM
• Perform an inventory of assets using Oracle GraalVM
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Oracle GraalVM. Oracle's security alert documentation is referenced but not examined in detail. Defenders should verify exposure by checking network access controls, review and apply Oracle's security updates for GraalVM, and assess potential impacts on confidentiality, integrity, and availability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.