Is CVE-2026-83357 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83357 being exploited in the wild.

How severe is CVE-2026-83357?

High severity, with a CVSS score of 8.1, published 15 September 2026.

Which products and versions are affected?

Oracle Graalvm 25.0.4.1; Oracle GraalVM for JDK 17 23.0.13.1; Oracle GraalVM for JDK 21 23.1.12.1.

Is there a fix for CVE-2026-83357?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-83357 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-83357?

Check whether you run Oracle Graalvm, Oracle GraalVM for JDK 17 or Oracle GraalVM for JDK 21 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83357: Oracle GraalVM compiler remote code execution

CVE-2026-83357 · Severity: high · CVSS 8.1 · Published 2026-09-15

Oracle GraalVM is a high-performance Java virtual machine used to run Java applications. A vulnerability in its compiler component allows remote attackers to take over systems running affected versions of GraalVM without authentication. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system.

Technologies: Oracle Graalvm. Vendors: Oracle.

Quick answers

Is CVE-2026-83357 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83357 being exploited in the wild.
How severe is CVE-2026-83357?: High severity, with a CVSS score of 8.1, published 15 September 2026.
Which products and versions are affected?: Oracle Graalvm 25.0.4.1; Oracle GraalVM for JDK 17 23.0.13.1; Oracle GraalVM for JDK 21 23.1.12.1.
Is there a fix for CVE-2026-83357?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83357 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-83357?: Check whether you run Oracle Graalvm, Oracle GraalVM for JDK 17 or Oracle GraalVM for JDK 21 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution vulnerability exists in the Oracle GraalVM compiler component affecting versions GraalVM for JDK 17 (23.0.13.1), GraalVM for JDK 21 (23.1.12.1), and GraalVM (25.0.4.1). The vulnerability is triggered via network access over HTTP and requires high complexity but no authentication or user interaction. An unauthenticated remote attacker can exploit this to achieve complete system compromise including unauthorized code execution, data exposure, and system disruption. The vulnerability is classified as difficult to exploit due to its attack complexity requirements.

Affected products

Oracle GraalVM for JDK 17 23.0.13.1
Oracle GraalVM for JDK 21 23.1.12.1
Oracle GraalVM 25.0.4.1

Timeline

2026-09-15: disclosed

References

https://www.oracle.com/security-alerts/cspusep2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.