CVE-2026-83368: Oracle GraalVM Compiler vulnerability allowing unauthorized data access

CVE-2026-83368 · Severity: high · CVSS 7 · Published 2026-09-15

Oracle GraalVM is a high-performance Java runtime used in cloud and enterprise environments. A vulnerability in its compiler component allows unauthenticated attackers to access sensitive data, modify information, and cause service interruptions, potentially compromising applications relying on GraalVM for secure data processing.

Technologies: Oracle Graalvm, Oracle GraalVM Enterprise Edition, Oracle Graalvm For Jdk. Vendors: Oracle.

Quick answers

Is CVE-2026-83368 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-83368 being exploited in the wild.
How severe is CVE-2026-83368?
High severity, with a CVSS score of 7, published 15 September 2026.
Which products and versions are affected?
Oracle Graalvm 25.0.4.1 and later; Oracle GraalVM Enterprise Edition 21.3.19.1 and later; Oracle Graalvm For Jdk 21: 23.1.12.1 and later.
Is there a fix for CVE-2026-83368?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83368 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-83368?
Check whether you run Oracle Graalvm, Oracle GraalVM Enterprise Edition or Oracle Graalvm For Jdk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a difficult-to-exploit vulnerability in the Compiler component of Oracle GraalVM for JDK, GraalVM Enterprise Edition, and standalone GraalVM. The vulnerability is network-reachable via HTTP and requires no authentication or user interaction. A successful exploit can result in unauthorized read access to critical data, limited write/delete access to accessible data, and partial denial of service. The attack vector is network-based with high complexity (AC:H). Patches are available for affected versions: GraalVM for JDK 17 (23.0.13.1+), JDK 21 (23.1.12.1+), GraalVM Enterprise Edition (21.3.19.1+), and standalone GraalVM (25.0.4.1+).

Affected products

  • Oracle GraalVM for JDK 17: 23.0.13.1 and later
  • Oracle GraalVM for JDK 21: 23.1.12.1 and later
  • Oracle GraalVM Enterprise Edition 21.3.19.1 and later
  • Oracle GraalVM 25.0.4.1 and later

Timeline

  • 2026-09-15: disclosed: CVE-2026-83368 publicly disclosed by NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.