Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure – unauthorized Helidon data read
Action: Assess Impact
AI Analysis

Impact

The Oracle Helidon product contains a vulnerability in the LRA component that permits an unauthenticated network attacker with HTTP access to read a subset of data exposed by Helidon. No privileges or additional authentication are required, and the flaw can expose confidential information without altering Helidon functionality or creating denial of service.

Affected Systems

Affected hosts run Oracle Helidon versions 4.0.0 through 4.5.5. These versions are supported by Oracle Fusion Middleware and are listed as vulnerable in the Oracle security alert for October 2026.

Risk and Exploitability

The CVSS v3.1 base score is 3.7, indicating a low severity attack mainly impacting confidentiality. The EPSS score is unavailable, and the vulnerability is not in the CISA KEV catalog, suggesting limited known exploitation. The attack vector is remote over HTTP, requiring no authentication or elevated privileges, so any host exposed to the public or lateral network can be compromised to read Helidon data.

Generated by OpenCVE AI on October 21, 2026 at 04:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Helidon to a non‑affected version (>=4.6.0) or apply the vendor‑issued patch.
  • If an immediate upgrade is not feasible, isolate Helidon services behind network segmentation or firewall rules that deny unauthenticated HTTP traffic.
  • Enforce application‑level authentication or restrict access to Helidon endpoints to authorized users only.

Generated by OpenCVE AI on October 21, 2026 at 04:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
Title Helidon LRA Unauthorized Data Read via Unauthenticated HTTP Access
Weaknesses CWE-200

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-11-06T21:34:25.776Z

Reserved: 2026-09-28T15:40:09.492Z

Link: CVE-2026-101576

cve-icon Vulnrichment

Updated: 2026-11-06T21:33:57.715Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-10-20T22:18:10.887

Modified: 2026-11-06T22:17:49.677

Link: CVE-2026-101576

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T01:00:17Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor