Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
Published: 2026-08-18
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability exists in Oracle Helidon’s Imperative Web Server component, allowing any unauthenticated user with network access over HTTP to create, delete, or modify critical data and to obtain full access to all Helidon-served data. These actions can also lead to a partial denial of service. The flaw carries a high confidentiality and integrity impact, and a moderate availability impact, as reflected in its CVSS 3.1 score of 9.4.

Affected Systems

Oracle Helidon Imperative Web Server, affected versions 4.0.0 through 4.4.1.

Risk and Exploitability

The flaw is reachable via ordinary HTTP traffic and requires no authentication, making it readily exploitable by anyone with network reach to the Helidon service. The CVSS 3.1 base score of 9.4 reflects severe impact on confidentiality and integrity and a lower but still significant availability impact. An EPSS score of < 1 % indicates the current probability of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is unauthenticated HTTP traffic targeting the Helidon server. The vulnerability affects Helidon releases 4.0.0‑4.4.1.

Generated by OpenCVE AI on August 28, 2026 at 20:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Helidon patch or upgrade to a newer Helidon version that includes the fix, as announced in Oracle’s security advisory.
  • Restrict inbound HTTP traffic to the Helidon service using firewalls or network segmentation, allowing only trusted networks to reach it.
  • Enforce mandatory authentication or additional application‑level access controls to limit privileged operations to authorized users.

Generated by OpenCVE AI on August 28, 2026 at 20:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Title Oracle Helidon Imperative Web Server Remote Unauthenticated Data Access and Partial Denial of Service

Fri, 28 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access and Partial DoS in Oracle Helidon 4.5.0

Thu, 20 Aug 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access and Partial DoS in Oracle Helidon 4.5.0

Wed, 19 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack Enables Unauthorized Data Access and Partial DoS in Oracle Helidon 4.5.0

Wed, 19 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Attack Enables Unauthorized Data Access and Partial DoS in Oracle Helidon 4.5.0
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T04:02:29.887Z

Reserved: 2026-08-04T22:06:34.621Z

Link: CVE-2026-71167

cve-icon Vulnrichment

Updated: 2026-08-19T12:08:24.761Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:18.050

Modified: 2026-08-28T05:16:44.307

Link: CVE-2026-71167

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:15:06Z

Weaknesses