Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle Helidon's Imperative Web Server, affecting versions 3.0.0 through 3.2.17, allows an unauthenticated attacker with network access via HTTP to compromise Helidon, enabling unauthorized access to all data the server exposes. This results in a high confidentiality impact and potential exposure of critical data.

Affected Systems

Oracle Helidon versions 3.0.0 through 3.2.17, specifically the Imperative Web Server component, are affected.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 highlights a medium‑high risk to confidentiality. The EPSS metric indicates a very low exploitation probability (< 1 %). The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by issuing unauthenticated HTTP requests to the Helidon service from any host that can reach it over the network; no credentials or special privileges are required.

Generated by OpenCVE AI on August 28, 2026 at 23:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install the latest Oracle Helidon patch or newer release from Oracle as soon as it becomes available.
  • Configure firewalls or network segmentation to restrict inbound traffic to the Helidon HTTP endpoints so that only trusted hosts can reach them.
  • Ensure that Helidon‑served resources require proper authentication and authorization before permitting access.
  • Enable logging and monitoring of HTTP traffic to detect and respond to any unauthorized request patterns.

Generated by OpenCVE AI on August 28, 2026 at 23:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Leading to Confidential Data Exposure in Oracle Helidon
Weaknesses CWE-284

Fri, 28 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Tue, 25 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Leading to Confidential Data Exposure in Oracle Helidon
Weaknesses CWE-200
CWE-284

Thu, 20 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Retrieval in Oracle Helidon 3.2.18
Weaknesses CWE-284
CWE-287

Thu, 20 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Retrieval in Oracle Helidon 3.2.18
Weaknesses CWE-284
CWE-287

Wed, 19 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Exploitation in Oracle Helidon 3.2.18
Weaknesses CWE-284
CWE-287

Wed, 19 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Exploitation in Oracle Helidon 3.2.18
Weaknesses CWE-284
CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:3.2.18:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T04:38:57.480Z

Reserved: 2026-08-13T18:41:45.882Z

Link: CVE-2026-73878

cve-icon Vulnrichment

Updated: 2026-08-25T01:26:44.429Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:20.163

Modified: 2026-08-28T05:16:44.660

Link: CVE-2026-73878

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:45:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor