Oracle GraalVM Compiler RCE via HTTP before 25.0.4.1
CVE-2026-83408 Published on September 15, 2026
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability Analysis
CVE-2026-83408 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2026-83408 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2026-83408
stack.watch emails you whenever new vulnerabilities are published in Oracle GraalVM or Oracle. Just hit a watch button to start following.
Affected Versions
Oracle Corporation Oracle GraalVM for JDK, Oracle GraalVM:- Version Oracle GraalVM for JDK 17:23.0.13.1 is affected.
- Version Oracle GraalVM for JDK 21:23.1.12.1 is affected.
- Version Oracle GraalVM:25.0.4.1 is affected.