CVE-2026-87367 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Java SE, GraalVM for JDK, and GraalVM Enterprise Edition deployments should assess their exposure, especially in environments where untrusted code execution is a concern. This includes reviewing and applying patches or updates provided by Oracle, and verifying the integrity of affected products.

Why it matters

CVE-2026-87367 is a low-severity vulnerability in Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition that allows an unauthenticated network attacker to potentially compromise affected products, leading to data integrity impacts. Defenders should verify deployment integrity, assess exposure, and apply patches or updates as needed.

• Potential unauthorized data modifications
• Need for verification of deployment integrity
• Possible impact on data integrity in certain environments

Technical summary

The vulnerability, tracked as CVE-2026-87367, affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. It is located in the JAXP component and has a CVSS score of 3.7, indicating a low-severity issue. An unauthenticated attacker with network access could exploit this vulnerability to compromise the affected products, potentially leading to unauthorized updates, insertions, or deletions of accessible data.

Defensive priority

Defenders should prioritize verifying the integrity of Java SE, GraalVM for JDK, and GraalVM Enterprise Edition deployments, especially in environments where untrusted code execution is a concern.

Recommended defensive actions

• Verify the integrity of Java SE, GraalVM for JDK, and GraalVM Enterprise Edition deployments
• Assess exposure in environments where untrusted code execution is a concern
• Review and apply patches or updates provided by Oracle
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor
• Review compensating controls for exposed systems while remediation is scheduled and verified. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review the supplied
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 3.7 and the potential impact on data integrity. However, specific details about exploitation are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.