Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-08-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Helidon Imperative Web Server contains an access control flaw that lets an unauthenticated attacker issuing HTTP requests change or read Helidon‑accessible data that is not intended for public exposure. The vulnerability affects versions 4.0.0 through 4.4.1 and allows updates, inserts, or deletions as well as unauthorized read access to some data.

Affected Systems

Oracle Helidon versions 4.0.0‑4.4.1 are affected, specifically the Imperative Web Server component. No other Oracle products or Helidon releases are listed as impacted by the CNA.

Risk and Exploitability

The CVSS v3.1 base score of 6.5 indicates moderate‑to‑high severity with confidentiality and integrity effects. The EPSS score is less than 1 %, implying a very low likelihood of exploitation currently. The vulnerability can be triggered by any unauthenticated actor with network access to the Helidon HTTP interface, without requiring credentials or elevated privileges. Although the flaw is not listed in CISA KEV, the ability to alter and expose data justifies vigilance for organizations running Helidon 4.0.0‑4.4.1.

Generated by OpenCVE AI on August 28, 2026 at 21:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Helidon to the latest version that includes the vendor‑supplied fix or security update.
  • If an upgrade is not feasible immediately, restrict inbound HTTP traffic to Helidon endpoints through firewall or API gateway rules, limiting access to trusted hosts only.
  • Enable comprehensive logging and monitoring of Helidon operations to detect and respond to unauthorized data modifications or information disclosures.

Generated by OpenCVE AI on August 28, 2026 at 21:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Control Exploit in Oracle Helidon 4.0‑4.4.1

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Fri, 21 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server Data Access Control Bypass

Thu, 20 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server Data Access Control Bypass

Thu, 20 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Control Exploit in Oracle Helidon 4.5.0
Weaknesses CWE-284

Thu, 20 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Access Control Exploit in Oracle Helidon 4.5.0
Weaknesses CWE-284

Wed, 19 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploitation Allows Unauthorized Data Modification and Access in Oracle Helidon 4.5.0
Weaknesses CWE-284

Wed, 19 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploitation Allows Unauthorized Data Modification and Access in Oracle Helidon 4.5.0
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:55:54.512Z

Reserved: 2026-08-13T18:41:45.884Z

Link: CVE-2026-73892

cve-icon Vulnrichment

Updated: 2026-08-20T18:11:23.458Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:21.757

Modified: 2026-08-28T20:19:47.983

Link: CVE-2026-73892

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T22:00:15Z

Weaknesses