# CVE-2026-83368: Oracle GraalVM Compiler vulnerability allowing unauthorized data access

Source: https://junglewise.ai/threats/cve-2026-83368-oracle-graalvm-compiler-vulnerability-allowing-unauthorized-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83368 · Severity: high · CVSS 7 · Published 2026-09-15

Oracle GraalVM is a high-performance Java runtime used in cloud and enterprise environments. A vulnerability in its compiler component allows unauthenticated attackers to access sensitive data, modify information, and cause service interruptions, potentially compromising applications relying on GraalVM for secure data processing.

Technologies: [Oracle Graalvm](https://junglewise.ai/threats/technologies/graalvm), [Oracle GraalVM Enterprise Edition](https://junglewise.ai/threats/technologies/graalvm-enterprise-edition), [Oracle Graalvm For Jdk](https://junglewise.ai/threats/technologies/graalvm-for-jdk). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-83368 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83368 being exploited in the wild.

**How severe is CVE-2026-83368?** High severity, with a CVSS score of 7, published 15 September 2026.

**Which products and versions are affected?** Oracle Graalvm 25.0.4.1 and later; Oracle GraalVM Enterprise Edition 21.3.19.1 and later; Oracle Graalvm For Jdk 21: 23.1.12.1 and later.

**Is there a fix for CVE-2026-83368?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-83368 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-83368?** Check whether you run Oracle Graalvm, Oracle GraalVM Enterprise Edition or Oracle Graalvm For Jdk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a difficult-to-exploit vulnerability in the Compiler component of Oracle GraalVM for JDK, GraalVM Enterprise Edition, and standalone GraalVM. The vulnerability is network-reachable via HTTP and requires no authentication or user interaction. A successful exploit can result in unauthorized read access to critical data, limited write/delete access to accessible data, and partial denial of service. The attack vector is network-based with high complexity (AC:H). Patches are available for affected versions: GraalVM for JDK 17 (23.0.13.1+), JDK 21 (23.1.12.1+), GraalVM Enterprise Edition (21.3.19.1+), and standalone GraalVM (25.0.4.1+).

## Affected products

- Oracle GraalVM for JDK 17: 23.0.13.1 and later
- Oracle GraalVM for JDK 21: 23.1.12.1 and later
- Oracle GraalVM Enterprise Edition 21.3.19.1 and later
- Oracle GraalVM 25.0.4.1 and later

## Timeline

- 2026-09-15: disclosed: CVE-2026-83368 publicly disclosed by NVD

## References

- [https://www.oracle.com/security-alerts/cspusep2026.html](https://www.oracle.com/security-alerts/cspusep2026.html)

## Related threats

- [Oracle Java SE JSSE protocol handling vulnerability](https://junglewise.ai/threats/cve-2026-114820-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk)
- [Oracle Java SE JSSE remote data exposure and modification](https://junglewise.ai/threats/cve-2026-91403-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)
- [Oracle Java SE compiler vulnerability in data access](https://junglewise.ai/threats/cve-2026-91487-vulnerability-in-oracle-java-se-component-compiler-supported)
- [Oracle Java SE JGSS information disclosure](https://junglewise.ai/threats/cve-2026-91464-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)
- [Oracle Java SE JGSS information exposure with user interaction](https://junglewise.ai/threats/cve-2026-91463-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle)