Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Helidon versions 4.0.0 through 4.4.1 include a vulnerability in its Imperative Web Server component that allows an unauthenticated user with network access to HTTP traffic to read a subset of data exposed by Helidon. The flaw provides limited confidentiality exposure (low impact) but still permits unauthorized extraction of information without any authentication or additional privileges. This is a CWE-284 Improper Access Control flaw.

Affected Systems

The vulnerability affects Oracle Helidon versions 4.0.0 through 4.4.1. No later releases are currently listed as affected. The product is part of Oracle Fusion Middleware and is distributed under the Helidon brand.

Risk and Exploitability

The CVSS 3.1 base score of 5.3 indicates medium severity and relies solely on network access (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). The associated EPSS score is less than 1% and the vulnerability is not included in CISA's KEV catalog, meaning there are no known publicly disclosed exploits at this time. However, an attacker who scans for exposed Helidon services could potentially exploit the flaw by simply connecting over HTTP. Based on the description, it is inferred that the attack vector is via unauthenticated HTTP traffic.

Generated by OpenCVE AI on August 28, 2026 at 21:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Oracle Helidon patch or upgrade to a fixed version released by Oracle.
  • Configure firewall or reverse‑proxy rules to block unauthenticated HTTP traffic to the Helidon service until the vulnerability is resolved.
  • Monitor network logs for attempts to connect to Helidon and investigate any anomalous activity promptly.
  • Review Helidon configuration to enforce proper access controls on all protected resources, ensuring that unauthenticated requests cannot retrieve sensitive data.

Generated by OpenCVE AI on August 28, 2026 at 21:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Exposure in Oracle Helidon Imperative Web Server

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Fri, 21 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Disclosure in Oracle Helidon 4.5.0

Thu, 20 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Disclosure in Oracle Helidon 4.5.0

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Read Access in Oracle Helidon 4.5.0
Weaknesses CWE-200

Thu, 20 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Read Access in Oracle Helidon 4.5.0
Weaknesses CWE-200

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Read Access in Oracle Helidon Imperative Web Server
Weaknesses CWE-200

Wed, 19 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Read Access in Oracle Helidon Imperative Web Server
Weaknesses CWE-200

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T18:24:29.856Z

Reserved: 2026-08-13T18:41:45.882Z

Link: CVE-2026-73872

cve-icon Vulnrichment

Updated: 2026-08-20T18:11:07.334Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:19.453

Modified: 2026-08-28T20:19:45.957

Link: CVE-2026-73872

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T21:45:03Z

Weaknesses