Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Imperative Web Server component of Oracle Helidon allows an unauthenticated attacker with network access to read a subset of data that is normally protected. The vulnerability results in the disclosure of sensitive information, exclusively affecting confidentiality and leaving integrity and availability untouched.

Affected Systems

Oracle Helidon versions 3.0.0 through 3.2.17, part of Oracle Fusion Middleware, are affected. The affected component is the Imperative Web Server.

Risk and Exploitability

The CVSS 3.1 base score of 5.3 indicates a medium-risk vulnerability that impacts confidentiality. An attacker can exploit the flaw over the network using HTTP without any authentication or privileges. The EPSS score of less than 1% and absence from the CISA KEV catalog suggest no widespread exploitation has been observed, yet the ease of attack qualifies it as a reasonable risk for exposed Helidon instances.

Generated by OpenCVE AI on August 28, 2026 at 21:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Helidon to a patched version that fixes the web server access control flaw.
  • Restrict Helidon exposure by placing it behind a VPN or firewall and limiting HTTP access to trusted hosts.
  • Implement additional authentication or authorization controls on Helidon endpoints so that sensitive data is protected behind proper security checks.

Generated by OpenCVE AI on August 28, 2026 at 21:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Exposure in Helidon Imperative Web Server

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Fri, 21 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Helidon Web Server Authorization Flaw Enables Data Exposure

Thu, 20 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Helidon Web Server Authorization Flaw Enables Data Exposure

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server Unauthenticated Data Exposure via HTTP
Weaknesses CWE-284

Thu, 20 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server Unauthenticated Data Exposure via HTTP
Weaknesses CWE-284

Wed, 19 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Access in Oracle Helidon Web Server
Weaknesses CWE-284

Wed, 19 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Access in Oracle Helidon Web Server
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:3.2.18:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T18:25:29.923Z

Reserved: 2026-08-13T18:41:45.882Z

Link: CVE-2026-73877

cve-icon Vulnrichment

Updated: 2026-08-20T18:11:13.372Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:20.047

Modified: 2026-08-28T20:19:46.510

Link: CVE-2026-73877

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T21:30:05Z

Weaknesses