HighVulnerability

CVE-2026-87287

Oracle GraalVM Compiler Remote Takeover

Published Sep 15, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS8.1High · v3.1

EPSS0.37%32nd percentile

CISA KEVNoNot listed

In the wildNoneNo exploitation reported

Vendor: Oracle Corporation

IdentifiersCVE-2026-87287CWE-284 · Improper Access Control

CVE-2026-87287 is a high-severity vulnerability in the Compiler component of Oracle GraalVM, affecting supported version 25.0.4.1. An unauthenticated attacker with network access over HTTP can compromise an affected Oracle GraalVM instance. Oracle rates exploitation as difficult; no vulnerable function or technical root cause is specified.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in complete takeover of the affected Oracle GraalVM instance, with high confidentiality, integrity, and availability impact. The CVSS v3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Public exploits

Exploits

No public exploits tracked yet. Mallory keeps watching.

View more in app →

No public exploit code observed for this vulnerability. Mallory keeps watching.

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Oracle CorporationGraalvmapplication

External references

References

MITRE CVEcve.org · CVE-2026-87287 NVDnvd.nist.gov/vuln/detail/CVE-2026-87287 MITRE CWE · CWE-284Improper Access Control oracle.comoracle.com/security-alerts/oracle-open-source-cves-outside-other-oracle-public-documents.html

Activity feed

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

ghsa syntheticNews · Sep 15, 2026GHSA-4c7c-57v9-g6f5A high-severity, difficult-to-exploit network vulnerability in the Oracle GraalVM Compiler component affecting supported Oracle GraalVM version 25.0.4.1. An unauthenticated attacker with HTTP network access could compromise and take over the GraalVM instance, affecting confidentiality, integrity, and availability.Read more ↗cvefeed high severityNews · Sep 15, 2026CVE-2026-87287 - Vulnerability in the Oracle GraalVM product of OraA high-severity (CVSS 8.1) network-accessible vulnerability in the Compiler component of Oracle GraalVM 25.0.4.1. An unauthenticated attacker can attack via HTTP; successful exploitation could fully compromise the affected Oracle GraalVM instance.Read more ↗

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity2Community discussion across Reddit, Mastodon, and other social sources.

HighVulnerability

CVE-2026-87287

Oracle GraalVM Compiler Remote Takeover

Published Sep 15, 2026 · Updated 2 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS8.1High · v3.1

EPSS0.37%32nd percentile

CISA KEVNoNot listed

In the wildNoneNo exploitation reported

Vendor: Oracle Corporation

IdentifiersCVE-2026-87287CWE-284 · Improper Access Control

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Public exploits

Exploits

No public exploits tracked yet. Mallory keeps watching.

View more in app →

No public exploit code observed for this vulnerability. Mallory keeps watching.

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Oracle CorporationGraalvmapplication

External references

References

Activity feed

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity2Community discussion across Reddit, Mastodon, and other social sources.