Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-08-18
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Helidon, part of Oracle Fusion Middleware, contains an Imperative Web Server component that in versions 4.0.0 through 4.4.1 has an access control weakness. The vulnerability allows a low‑privileged attacker with network access via HTTP to perform unauthorized updates, inserts, deletes, and read operations on data exposed by Helidon. The CVE assigns a CVSS 3.1 score of 5.4, indicating low confidentiality and integrity impact while availability remains unaffected.

Affected Systems

The affected systems are Oracle Helidon 4.0.0 through 4.4.1, part of Oracle Fusion Middleware. No other product versions or variants are listed as impacted.

Risk and Exploitability

The CVE states the vulnerability is easily exploitable and requires only low privilege and standard HTTP network access. The CVSS 3.1 Base Score of 5.4 indicates medium‑level confidentiality and integrity impact while availability remains unchanged. No code execution or availability impact is reported. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Deployments exposing Helidon to untrusted networks could face elevated risk because the attack vector is purely network‑based and does not require authentication.

Generated by OpenCVE AI on August 28, 2026 at 21:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade Helidon to a version that resolves the access control flaw.
  • Restrict Helidon service exposure by implementing role‑based access controls and limiting network access to trusted IP ranges.
  • Deploy network segmentation or firewalls to block unauthorized HTTP traffic to the Helidon endpoints while a permanent fix is applied.

Generated by OpenCVE AI on August 28, 2026 at 21:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Read via Access Control Weakness in Oracle Helidon

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Tue, 25 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Access Control Failure in Oracle Helidon 4.5.0 Leading to Unauthorized Data Alteration and Read via HTTP
Weaknesses CWE-284

Thu, 20 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Title Access Control Failure in Oracle Helidon 4.5.0 Leading to Unauthorized Data Alteration and Read via HTTP
Weaknesses CWE-284
CWE-285

Thu, 20 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Helidon Access Control Vulnerability Allows Unauthorized Data Modification and Read
Weaknesses CWE-284
CWE-285

Wed, 19 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Title Helidon Access Control Vulnerability Allows Unauthorized Data Modification and Read
Weaknesses CWE-284
CWE-285

Wed, 19 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
CWE-285

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T18:11:30.712Z

Reserved: 2026-08-13T18:41:45.882Z

Link: CVE-2026-73881

cve-icon Vulnrichment

Updated: 2026-08-25T01:32:29.497Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:20.503

Modified: 2026-08-28T20:19:46.733

Link: CVE-2026-73881

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T22:00:15Z

Weaknesses