Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in Oracle Helidon’s Imperative Web Server component across versions 4.0.0 to 4.5.0. An attacker who can reach the server over HTTP, without any prior authentication, can create, delete, or alter data associated with Helidon. This unauthorized data manipulation results in a loss of integrity for critical data or any data exposed through Helidon. The flaw is an authorization bypass, mapped to CWE-284.

Affected Systems

Oracle Helidon versions 4.0.0 through 4.5.0 are affected by the vulnerability, which targets the Imperative Web Server component. No other Helidon products or versions beyond this range are mentioned.

Risk and Exploitability

The CVSS 3.1 base score of 7.5 classifies the issue as high severity. The EPSS score of less than 1 % indicates a very low current exploitation probability, and the vulnerability is not included in the CISA KEV catalog. Attackers can exploit the flaw remotely over HTTP without authentication or elevated privileges, gaining control over critical or all Helidon‑managed data.

Generated by OpenCVE AI on August 28, 2026 at 20:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle Helidon 4.5.0 security patch or upgrade to the latest Helidon release
  • Enable authentication and enforce proper authorization controls around data modification endpoints
  • Restrict external network traffic to Helidon using firewalls, VPNs, or internal routing policies

Generated by OpenCVE AI on August 28, 2026 at 20:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification in Helidon 4.5.1

Fri, 28 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Tue, 25 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification in Helidon 4.5.1
Weaknesses CWE-284

Thu, 20 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification Vulnerability in Oracle Helidon 4.5.1
Weaknesses CWE-285

Thu, 20 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification Vulnerability in Oracle Helidon 4.5.1
Weaknesses CWE-285

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Vulnerability Enables Unauthorized Data Modification in Oracle Helidon
Weaknesses CWE-285

Wed, 19 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Vulnerability Enables Unauthorized Data Modification in Oracle Helidon
Weaknesses CWE-285

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T04:39:34.518Z

Reserved: 2026-08-13T18:41:45.882Z

Link: CVE-2026-73879

cve-icon Vulnrichment

Updated: 2026-08-25T01:29:31.671Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:20.277

Modified: 2026-08-28T05:16:44.777

Link: CVE-2026-73879

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:30:08Z

Weaknesses