Technology · Oracle
Oracle GraalVM Enterprise Edition vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 55 vulnerabilities in Oracle GraalVM Enterprise Edition: 0 in the last 7 days and 37 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114820, was published on 24 October 2026. 35 vulnerabilities in the last four weeks, up 3400% on the four before (1). 2 critical against 0.
- Last 7 days
- 0
- Last 90 days
- 37
- Critical, all time
- 2
- Exploited in the wild
- 0
About Oracle GraalVM Enterprise Edition
Oracle's commercial distribution of GraalVM, a polyglot virtual machine supporting multiple programming languages.
Latest Oracle GraalVM Enterprise Edition vulnerabilities
- CVE-2026-114820: Oracle Java SE JSSE protocol handling vulnerabilitycriticalCVSS 9.1
- CVE-2026-91403: Oracle Java SE JSSE remote data exposure and modificationcriticalCVSS 9.1
- CVE-2026-91487: Oracle Java SE compiler vulnerability in data accessmediumCVSS 4.8
- CVE-2026-91464: Oracle Java SE JGSS information disclosuremediumCVSS 5.3
- CVE-2026-91463: Oracle Java SE JGSS information exposure with user interactionmediumCVSS 5.3
- CVE-2026-91462: Oracle Java SE JGSS integrity bypassmediumCVSS 5.9
- CVE-2026-91453: Oracle Java SE integrity bypass in Lightweight HTTP ServermediumCVSS 5.3
- CVE-2026-91452: Oracle Java SE networking data integrity bypassmediumCVSS 5.3
- CVE-2026-91451: Oracle Java SE integrity bypass in NetworkingmediumCVSS 5.3
- CVE-2026-91418: Oracle Java SE denial of service in ImageIOmediumCVSS 5.3
- CVE-2026-91417: Oracle Java SE and GraalVM Enterprise denial of service in CORBAmediumCVSS 5.3
- CVE-2026-91415: Oracle Java SE 2D graphics denial of service and data accesshighCVSS 7
- CVE-2026-91411: Oracle Java SE JGSS denial of service and data accessmediumCVSS 6.5
- CVE-2026-91410: Oracle Java SE partial denial of service in Libraries componentmediumCVSS 5.3
- CVE-2026-91398: Oracle Java SE networking vulnerability via SOCKS5mediumCVSS 6.8
- CVE-2026-91396: Oracle Java SE integrity and availability vulnerability in UtilitymediumCVSS 6.5
- CVE-2026-91395: Oracle Java SE data integrity and denial of service in UtilitymediumCVSS 6.5
- CVE-2026-91385: Oracle Java SE data integrity vulnerability in JavaFXmediumCVSS 5.4
- CVE-2026-91382: Oracle Java SE 2D graphics vulnerabilitymediumCVSS 6.5
- CVE-2026-91380: Oracle Java SE data access vulnerability in Utility componentmediumCVSS 4
- CVE-2026-91379: Oracle Java SE integrity vulnerability in JDK toolsmediumCVSS 4.7
- CVE-2026-91375: Oracle Java SE integrity violation in Libraries componentmediumCVSS 4.7
- CVE-2026-91374: Oracle Java SE data access vulnerability in ServiceabilitymediumCVSS 4.8
- CVE-2026-91373: Oracle Java SE JSSE denial of servicemediumCVSS 5.3
- CVE-2026-91332: Oracle Java SE networking integrity bypassmediumCVSS 5.3
Most severe Oracle GraalVM Enterprise Edition vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-114820: Oracle Java SE JSSE protocol handling vulnerabilitycriticalCVSS 9.1
- CVE-2026-91403: Oracle Java SE JSSE remote data exposure and modificationcriticalCVSS 9.1
- CVE-2026-62574: Oracle Java SE and GraalVM compromise in Install componenthighCVSS 7.8
- CVE-2026-21945: Oracle Java SE and GraalVM denial of service in Security componenthighCVSS 7.5EPSS 0.5%
- CVE-2026-22016: Oracle Java SE JAXP information disclosurehighCVSS 7.5EPSS 0.4%
- CVE-2026-34282: Oracle Java SE and GraalVM denial of service in Networking componenthighCVSS 7.5EPSS 0.3%
- CVE-2026-47063: Oracle Java SE and GraalVM integrity vulnerability in LibrarieshighCVSS 7.5
- CVE-2025-53066: Oracle Java SE and GraalVM Information Exposure in JAXPhighCVSS 7.5
- CVE-2026-21932: Oracle Java SE improper URI handling in AWT and JavaFXhighCVSS 7.4EPSS 0.3%
- CVE-2026-83368: Oracle GraalVM Compiler vulnerability allowing unauthorized data accesshighCVSS 7EPSS 0.3%
Vulnerabilities per week
35 vulnerabilities in the last four weeks, up 3400% on the four before (1). 2 critical against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 35 | 2 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Oracle GraalVM Enterprise Edition vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/graalvm-enterprise-edition)<a href="https://junglewise.ai/threats/technologies/graalvm-enterprise-edition"><img src="https://junglewise.ai/threats/technologies/graalvm-enterprise-edition/badge.svg" alt="Oracle GraalVM Enterprise Edition vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/graalvm-enterprise-edition.json, and this page as text at https://junglewise.ai/threats/technologies/graalvm-enterprise-edition.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Oracle GraalVM Enterprise Edition vulnerabilities", https://junglewise.ai/threats/technologies/graalvm-enterprise-edition, 9 November 2026.