Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-08-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Helidon product of Oracle Fusion Middleware, specifically its Imperative Web Server component, contains a flaw that permits unauthenticated attackers with network access to send HTTP requests that expose confidential data. The vulnerability is easily exploitable and can lead to full access to all Helidon‑served data, posing a significant confidentiality risk.

Affected Systems

The affected product is Oracle Helidon, versions 4.0.0 through 4.4.1. The flaw resides in the web server layer that handles inbound HTTP traffic within the Oracle Fusion Middleware stack.

Risk and Exploitability

The CVSS v3.1 base score of 7.5 indicates a high risk condition. The vector states that a network attacker can exploit the flaw without authentication, so the potential for exploitation is substantial. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers could read any data exposed through Helidon, making prompt remediation essential.

Generated by OpenCVE AI on August 28, 2026 at 21:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Helidon to a version that contains the fix or remove the Helidon service from the network if an update is unavailable.
  • Restrict inbound HTTP traffic to Helidon to trusted sources only, using firewall rules or network segmentation.
  • Implement authentication and authorization controls for Helidon services to prevent unauthorized access.
  • Monitor logs for suspicious access attempts and enforce alerts for unauthorized access patterns.

Generated by OpenCVE AI on August 28, 2026 at 21:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Exposure in Oracle Helidon Web Server

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Tue, 25 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Exposure in Oracle Helidon Web Server

Tue, 25 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Confidential Data Disclosure in Oracle Helidon 4.5.0
Weaknesses CWE-285

Tue, 25 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Confidential Data Disclosure in Oracle Helidon 4.5.0
Weaknesses CWE-285

Thu, 20 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Confidential Data Breach in Oracle Helidon 4.5.0
Weaknesses CWE-284
CWE-288

Thu, 20 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Confidential Data Breach in Oracle Helidon 4.5.0
Weaknesses CWE-284
CWE-288

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Data Access via HTTP in Oracle Helidon Imperative Web Server
Weaknesses CWE-284
CWE-288

Wed, 19 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Data Access via HTTP in Oracle Helidon Imperative Web Server
Weaknesses CWE-284
CWE-288

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T16:47:37.209Z

Reserved: 2026-08-13T18:41:45.883Z

Link: CVE-2026-73884

cve-icon Vulnrichment

Updated: 2026-08-25T01:38:26.118Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:20.843

Modified: 2026-08-28T20:19:47.077

Link: CVE-2026-73884

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T22:00:15Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor