Loading vulnerability…
Oracle GraalVM Compiler Remote Takeover Vulnerability
CVE-2026-87286 is a high-severity vulnerability in the Compiler component of Oracle GraalVM, part of Oracle Java SE. Oracle GraalVM 25.0.4.1 is identified as an affected supported version. An unauthenticated attacker with network access over HTTP can exploit the issue, although Oracle rates exploitation as high complexity. The underlying flaw class and vulnerable function are not publicly specified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in takeover of the affected Oracle GraalVM instance. The CVSS v3.1 vector assigns high confidentiality, integrity, and availability impacts, indicating an attacker may obtain broad control over the affected deployment and its accessible data and services.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.