Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-08-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker who can reach Oracle Helidon over HTTP can cause the server to perform unauthorized update, insert or delete operations on Helidon-accessible data and can also read a subset of that data. The flaw appears in the Imperative Web Server component and affects confidentiality and integrity but not availability.

Affected Systems

The affected product is Oracle Helidon version 3.0.0 through 3.2.17. These releases contain the Imperative Web Server component that is vulnerable. Versions newer than 3.2.17 are not affected.

Risk and Exploitability

The attack vector is network based (AV:N) and authentication is not required, so an attacker with network access can exploit the flaw easily. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploits in the wild at this time. Nevertheless, the potential for unauthorized data loss or alteration warrants prompt attention.

Generated by OpenCVE AI on August 28, 2026 at 21:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Helidon to a non-affected version such as 3.2.18 or later
  • Configure network segmentation or firewall rules to limit external access to Helidon’s HTTP endpoints
  • Enable authentication and TLS on Helidon HTTP interfaces to harden access

Generated by OpenCVE AI on August 28, 2026 at 21:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Manipulation in Oracle Helidon

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Tue, 25 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Manipulation in Oracle Helidon

Tue, 25 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification and Read in Oracle Helidon
Weaknesses CWE-285

Tue, 25 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification and Read in Oracle Helidon
Weaknesses CWE-285

Thu, 20 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Manipulation via HTTP in Oracle Helidon
Weaknesses CWE-284
CWE-287

Thu, 20 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Manipulation via HTTP in Oracle Helidon
Weaknesses CWE-284
CWE-287

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Unauthorized Data Modification in Oracle Helidon 3.2.18
Weaknesses CWE-284
CWE-287

Wed, 19 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Unauthorized Data Modification in Oracle Helidon 3.2.18
Weaknesses CWE-284
CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:3.2.18:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:54:09.738Z

Reserved: 2026-08-13T18:41:45.881Z

Link: CVE-2026-73867

cve-icon Vulnrichment

Updated: 2026-08-25T01:25:41.278Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:18.873

Modified: 2026-08-28T20:19:45.383

Link: CVE-2026-73867

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T21:45:03Z

Weaknesses