Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17 and 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in Oracle’s Helidon Fusion Middleware Imperative Web Server component. Versions 3.0.0-3.2.17 and 4.0.0-4.4.1 are affected. An unauthenticated attacker who can reach Helidon over HTTP can read a subset of data accessible by the server, compromising confidentiality. The weakness can be classified as inappropriate exposure of information and authorization issues, underlying CWE 284.

Affected Systems

The affected product is Oracle Helidon, versions 3.0.0 through 3.2.17 and 4.0.0 through 4.4.1. These supported releases are listed in the Oracle CSPU August 2026 advisory. Systems running any of these builds are susceptible to the described read access flaw.

Risk and Exploitability

The CVSS base score of 5.3 reflects a moderate confidentiality impact. EPSS indicates a probability of less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting a very low likelihood of exploitation. Because the flaw allows unauthenticated exploitation over a network HTTP endpoint, an attacker with network reach can mount a simple request to obtain data without prior credentials. The lack of authentication means the attack can be automated and requires no special privileges.

Generated by OpenCVE AI on August 29, 2026 at 00:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the security update published in Oracle’s August 2026 CSPU for Helidon.
  • Configure Helidon to require authentication for all HTTP endpoints and confirm that no sensitive data is publicly exposed.
  • Restrict network access to Helidon by deploying firewall rules or IAM policies that limit connectivity to trusted hosts only.

Generated by OpenCVE AI on August 29, 2026 at 00:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Title Helidon Unauthorized Read Access via Unauthenticated HTTP Endpoint

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17 and 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Title Helidon Unauthorized Read Access via Unauthenticated HTTP Endpoint

Wed, 19 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Helidon Unauthorized Read Access via Unauthenticated HTTP Request
Weaknesses CWE-200
CWE-285

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Title Helidon Unauthorized Read Access via Unauthenticated HTTP Request
Weaknesses CWE-200
CWE-285

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T18:15:19.271Z

Reserved: 2026-08-04T22:06:34.621Z

Link: CVE-2026-71157

cve-icon Vulnrichment

Updated: 2026-08-19T14:24:22.797Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:16.840

Modified: 2026-08-28T20:19:43.873

Link: CVE-2026-71157

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T00:30:17Z

Weaknesses