Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by oracle

CVE-2026-83408

High 8.1

In plain English

A high-severity code injection in Oracle GraalVM for JDK, Oracle GraalVM from Oracle Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 63.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM for JDK, Oracle GraalVM. Successful attacks of this vulnerability can result in takeover of Oracle GraalVM for JDK, Oracle GraalVM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Ubuntu:22.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-83408
Ubuntu:24.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.04:LTSopenjdk-17no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.10openjdk-17no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.04:LTSopenjdk-17-cracno fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.10openjdk-17-cracno fix listedUBUNTU-CVE-2026-83408
Ubuntu:22.04:LTSopenjdk-18no fix listedUBUNTU-CVE-2026-83408
Ubuntu:22.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-83408
Ubuntu:24.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.04:LTSopenjdk-21no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.10openjdk-21no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.04:LTSopenjdk-21-cracno fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.10openjdk-21-cracno fix listedUBUNTU-CVE-2026-83408
Ubuntu:22.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-83408
Ubuntu:24.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.04:LTSopenjdk-25no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.10openjdk-25no fix listedUBUNTU-CVE-2026-83408
Ubuntu:22.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-83408
Ubuntu:24.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.04:LTSopenjdk-8no fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.10openjdk-8no fix listedUBUNTU-CVE-2026-83408
Ubuntu:22.04:LTSopenjdk-ltsno fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.04:LTSopenjdk-ltsno fix listedUBUNTU-CVE-2026-83408
Ubuntu:26.10openjdk-ltsno fix listedUBUNTU-CVE-2026-83408

Affected products (as reported)

VendorProductVersions
Oracle Corporation Oracle GraalVM for JDK, Oracle GraalVM Oracle GraalVM for JDK 17:23.0.13.1Oracle GraalVM for JDK 21:23.1.12.1Oracle GraalVM:25.0.4.1

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References