# Oracle GraalVM Enterprise Edition vulnerabilities Source: https://junglewise.ai/threats/technologies/graalvm-enterprise-edition Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/graalvm-enterprise-edition.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 55 vulnerabilities in Oracle GraalVM Enterprise Edition: 0 in the last 7 days and 37 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114820, was published on 24 October 2026. 35 vulnerabilities in the last four weeks, up 3400% on the four before (1). 2 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 35 - Last 90 days: 37 - All time: 55 (2 critical, 0 exploited in the wild) ## About Oracle GraalVM Enterprise Edition Oracle's commercial distribution of GraalVM, a polyglot virtual machine supporting multiple programming languages. ## Latest Oracle GraalVM Enterprise Edition vulnerabilities - [CVE-2026-114820: Oracle Java SE JSSE protocol handling vulnerability](https://junglewise.ai/threats/cve-2026-114820-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk) (critical, CVSS 9.1, published 24 Oct 2026) - [CVE-2026-91403: Oracle Java SE JSSE remote data exposure and modification](https://junglewise.ai/threats/cve-2026-91403-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (critical, CVSS 9.1, published 21 Oct 2026) - [CVE-2026-91487: Oracle Java SE compiler vulnerability in data access](https://junglewise.ai/threats/cve-2026-91487-vulnerability-in-oracle-java-se-component-compiler-supported) (medium, CVSS 4.8, published 20 Oct 2026) - [CVE-2026-91464: Oracle Java SE JGSS information disclosure](https://junglewise.ai/threats/cve-2026-91464-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91463: Oracle Java SE JGSS information exposure with user interaction](https://junglewise.ai/threats/cve-2026-91463-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91462: Oracle Java SE JGSS integrity bypass](https://junglewise.ai/threats/cve-2026-91462-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 5.9, published 20 Oct 2026) - [CVE-2026-91453: Oracle Java SE integrity bypass in Lightweight HTTP Server](https://junglewise.ai/threats/cve-2026-91453-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91452: Oracle Java SE networking data integrity bypass](https://junglewise.ai/threats/cve-2026-91452-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91451: Oracle Java SE integrity bypass in Networking](https://junglewise.ai/threats/cve-2026-91451-vulnerability-in-oracle-java-se-component-networking-supported) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91418: Oracle Java SE denial of service in ImageIO](https://junglewise.ai/threats/cve-2026-91418-vulnerability-in-the-oracle-java-se-oracle-javafx-oracle-graalvm) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91417: Oracle Java SE and GraalVM Enterprise denial of service in CORBA](https://junglewise.ai/threats/cve-2026-91417-vulnerability-in-the-oracle-java-se-oracle-graalvm-enterprise) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91415: Oracle Java SE 2D graphics denial of service and data access](https://junglewise.ai/threats/cve-2026-91415-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (high, CVSS 7, published 20 Oct 2026) - [CVE-2026-91411: Oracle Java SE JGSS denial of service and data access](https://junglewise.ai/threats/cve-2026-91411-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-91410: Oracle Java SE partial denial of service in Libraries component](https://junglewise.ai/threats/cve-2026-91410-vulnerability-in-oracle-java-se-component-libraries-supported) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91398: Oracle Java SE networking vulnerability via SOCKS5](https://junglewise.ai/threats/cve-2026-91398-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 6.8, published 20 Oct 2026) - [CVE-2026-91396: Oracle Java SE integrity and availability vulnerability in Utility](https://junglewise.ai/threats/cve-2026-91396-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-91395: Oracle Java SE data integrity and denial of service in Utility](https://junglewise.ai/threats/cve-2026-91395-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-91385: Oracle Java SE data integrity vulnerability in JavaFX](https://junglewise.ai/threats/cve-2026-91385-vulnerability-in-the-oracle-java-se-oracle-javafx-oracle-graalvm) (medium, CVSS 5.4, published 20 Oct 2026) - [CVE-2026-91382: Oracle Java SE 2D graphics vulnerability](https://junglewise.ai/threats/cve-2026-91382-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 6.5, published 20 Oct 2026) - [CVE-2026-91380: Oracle Java SE data access vulnerability in Utility component](https://junglewise.ai/threats/cve-2026-91380-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 4, published 20 Oct 2026) - [CVE-2026-91379: Oracle Java SE integrity vulnerability in JDK tools](https://junglewise.ai/threats/cve-2026-91379-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 4.7, published 20 Oct 2026) - [CVE-2026-91375: Oracle Java SE integrity violation in Libraries component](https://junglewise.ai/threats/cve-2026-91375-vulnerability-in-oracle-java-se-component-libraries-supported) (medium, CVSS 4.7, published 20 Oct 2026) - [CVE-2026-91374: Oracle Java SE data access vulnerability in Serviceability](https://junglewise.ai/threats/cve-2026-91374-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (medium, CVSS 4.8, published 20 Oct 2026) - [CVE-2026-91373: Oracle Java SE JSSE denial of service](https://junglewise.ai/threats/cve-2026-91373-vulnerability-in-oracle-java-se-component-jsse-supported-versions) (medium, CVSS 5.3, published 20 Oct 2026) - [CVE-2026-91332: Oracle Java SE networking integrity bypass](https://junglewise.ai/threats/cve-2026-91332-vulnerability-in-oracle-java-se-component-networking-supported) (medium, CVSS 5.3, published 20 Oct 2026) ## Most severe Oracle GraalVM Enterprise Edition vulnerabilities - [CVE-2026-114820: Oracle Java SE JSSE protocol handling vulnerability](https://junglewise.ai/threats/cve-2026-114820-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk) (critical, CVSS 9.1, published 24 Oct 2026) - [CVE-2026-91403: Oracle Java SE JSSE remote data exposure and modification](https://junglewise.ai/threats/cve-2026-91403-vulnerability-in-the-oracle-java-se-oracle-graalvm-for-jdk-oracle) (critical, CVSS 9.1, published 21 Oct 2026) - [CVE-2026-62574: Oracle Java SE and GraalVM compromise in Install component](https://junglewise.ai/threats/cve-2026-62574-oracle-java-se-and-graalvm-compromise-in-install-component) (high, CVSS 7.8, published 21 Jul 2026) - [CVE-2026-21945: Oracle Java SE and GraalVM denial of service in Security component](https://junglewise.ai/threats/cve-2026-21945-oracle-java-se-and-graalvm-denial-of-service-in-security) (high, CVSS 7.5, published 20 Jan 2026) - [CVE-2026-22016: Oracle Java SE JAXP information disclosure](https://junglewise.ai/threats/cve-2026-22016-oracle-java-se-jaxp-information-disclosure) (high, CVSS 7.5, published 21 Apr 2026) - [CVE-2026-34282: Oracle Java SE and GraalVM denial of service in Networking component](https://junglewise.ai/threats/cve-2026-34282-oracle-java-se-and-graalvm-denial-of-service-in-networking) (high, CVSS 7.5, published 21 Apr 2026) - [CVE-2026-47063: Oracle Java SE and GraalVM integrity vulnerability in Libraries](https://junglewise.ai/threats/cve-2026-47063-oracle-java-se-and-graalvm-integrity-vulnerability-in-libraries) (high, CVSS 7.5, published 21 Jul 2026) - [CVE-2025-53066: Oracle Java SE and GraalVM Information Exposure in JAXP](https://junglewise.ai/threats/cve-2025-53066-oracle-java-se-and-graalvm-information-exposure-in-jaxp) (high, CVSS 7.5, published 21 Oct 2025) - [CVE-2026-21932: Oracle Java SE improper URI handling in AWT and JavaFX](https://junglewise.ai/threats/cve-2026-21932-oracle-java-se-improper-uri-handling-in-awt-and-javafx) (high, CVSS 7.4, published 20 Jan 2026) - [CVE-2026-83368: Oracle GraalVM Compiler vulnerability allowing unauthorized data access](https://junglewise.ai/threats/cve-2026-83368-oracle-graalvm-compiler-vulnerability-allowing-unauthorized-data) (high, CVSS 7, published 15 Sep 2026) ## Vulnerabilities per week 35 vulnerabilities in the last four weeks, up 3400% on the four before (1). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 35 | 2 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Oracle technologies - [Oracle MySQL Server](https://junglewise.ai/threats/technologies/mysql-server): 163 vulnerabilities - [Oracle Hyperion Financial Management](https://junglewise.ai/threats/technologies/hyperion-financial-management): 142 vulnerabilities - [Oracle Helidon](https://junglewise.ai/threats/technologies/helidon): 130 vulnerabilities - [Oracle MySQL Cluster](https://junglewise.ai/threats/technologies/mysql-cluster): 129 vulnerabilities - [Oracle Coherence](https://junglewise.ai/threats/technologies/coherence): 113 vulnerabilities - [Oracle E-Business Suite](https://junglewise.ai/threats/technologies/e-business-suite): 110 vulnerabilities - [Oracle WebCenter Content](https://junglewise.ai/threats/technologies/webcenter-content): 110 vulnerabilities - [Oracle Commerce Guided Search](https://junglewise.ai/threats/technologies/commerce-guided-search): 104 vulnerabilities - [Oracle Commerce Experience Manager](https://junglewise.ai/threats/technologies/commerce-experience-manager): 102 vulnerabilities - [Oracle JD Edwards EnterpriseOne Tools](https://junglewise.ai/threats/technologies/jd-edwards-enterpriseone-tools): 101 vulnerabilities - [Oracle PeopleSoft Enterprise PeopleTools](https://junglewise.ai/threats/technologies/peopletools): 101 vulnerabilities - [Oracle Java SE](https://junglewise.ai/threats/technologies/java-se): 92 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Oracle GraalVM Enterprise Edition vulnerabilities", https://junglewise.ai/threats/technologies/graalvm-enterprise-edition, 9 November 2026.