CVE-2026-87287: 
Oracle GraalVM Enterprise vulnerability analysis and mitigation

CVE-2026-87287 is a high-severity improper access control vulnerability in the Compiler component of Oracle GraalVM, part of Oracle Java SE. It affects Oracle GraalVM version 25.0.4.1 and allows an unauthenticated remote attacker with network access via HTTP to achieve complete compromise of the affected instance. The vulnerability was published on September 15, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Oracle).

The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the Oracle GraalVM Compiler component fails to properly restrict access to a resource from unauthorized actors (GitHub Advisory). The attack vector is network-based via HTTP, requiring no privileges and no user interaction, though the attack complexity is rated High, meaning exploitation requires specific conditions or significant effort to be met. Successful exploitation can result in full takeover of the GraalVM instance. No public proof-of-concept code or detailed technical write-ups describing the precise exploitation mechanism have been identified at this time (GitHub Advisory).

Successful exploitation of CVE-2026-87287 results in complete compromise of the affected Oracle GraalVM instance, with high impact to confidentiality, integrity, and availability. An unauthenticated attacker could execute arbitrary code, read sensitive data, modify system data, and disrupt service availability on the affected host. The scope is limited to the vulnerable component itself (unchanged scope), but a full takeover could enable lateral movement within the broader environment depending on the deployment context (GitHub Advisory, Oracle).

As of the time of publication, there is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2026-87287 (GitHub Advisory). The EPSS score is approximately 0.238%, placing it in the 15th percentile for exploitation probability within the next 30 days. The NVD SSVC assessment classifies exploitation as "none" and the attack as not automatable, reflecting the high attack complexity requirement. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Oracle has released a patch for CVE-2026-87287, and users should update Oracle GraalVM from the affected version 25.0.4.1 to a patched release immediately. As a network-level workaround, administrators should apply network segmentation to restrict HTTP access to GraalVM instances to only trusted networks and IP ranges. Monitoring for anomalous HTTP traffic targeting GraalVM endpoints is also recommended as a compensating control. Patch details are available via GitHub Advisory GHSA-4c7c-57v9-g6f5 (GitHub Advisory, Oracle).