Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.18, 3.0.0-3.2.17 and 4.0.0-4.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Helidon versions 1.0.0 through 1.4.18, 3.0.0 through 3.2.17, and 4.0.0 through 4.4.1 contain a flaw in the Imperative Web Server that enables an attacker with low‑level network access over HTTPS to create, delete, or modify data. The escalation allows unauthorized access to all data that Helidon serves, thereby compromising confidentiality and integrity for affected installations.

Affected Systems

The vulnerability affects Oracle Helidon versions 1.0.0 through 1.4.18, 3.0.0 through 3.2.17, and 4.0.0 through 4.4.1 running within Oracle Fusion Middleware. No other releases are listed as affected.

Risk and Exploitability

With a CVSS score of 8.1 the flaw is considered high severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits yet. The attack vector involves an attacker with network access over HTTPS crafting requests to the Helidon server to perform unauthorized operations.

Generated by OpenCVE AI on August 28, 2026 at 20:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the patch for Oracle Helidon as provided in the Oracle security advisory.
  • Ensure that HTTPS endpoints are properly authenticated, restricting privileged operations to authorized users only.
  • Enable comprehensive logging and monitoring on Helidon to detect anomalous activity, and review logs regularly.

Generated by OpenCVE AI on August 28, 2026 at 20:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Helidon 4.5.0 Imperative Web Server Data Modification Vulnerability

Fri, 28 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.18, 3.0.0-3.2.17 and 4.0.0-4.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Fri, 21 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Helidon 4.5.0 Imperative Web Server Data Modification Vulnerability

Fri, 21 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269

Fri, 21 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Helidon Web Server Unauthorized Data Modification via Low-Privilege HTTPS Access

Thu, 20 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Title Helidon Web Server Unauthorized Data Modification via Low-Privilege HTTPS Access
Weaknesses CWE-284

Thu, 20 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 19 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server Unauthorized Data Modification via HTTPS
Weaknesses CWE-284

Wed, 19 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server Unauthorized Data Modification via HTTPS
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T04:31:57.621Z

Reserved: 2026-08-04T22:06:34.617Z

Link: CVE-2026-71110

cve-icon Vulnrichment

Updated: 2026-08-20T17:51:29.608Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:11.470

Modified: 2026-08-28T05:16:43.567

Link: CVE-2026-71110

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:45:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control