Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-08-18
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Helidon’s Imperative Web Server contains an improper access control flaw that allows unauthenticated HTTP requests to update, insert or delete data and to read restricted data. The vulnerability, classified as CWE‑284, compromises confidentiality and integrity of Helidon‑accessible information. With a CVSS 3.1 base score of 4.8, it poses a moderate risk but is still a serious issue that can lead to unauthorized data changes and disclosures.

Affected Systems

The flaw affects Oracle Helidon versions 4.0.0 through 4.5.0, specifically the Imperative Web Server component. No other supported Helidon releases are listed as impacted.

Risk and Exploitability

An attacker can exploit the issue from any network location that can reach Helidon over HTTP, without requiring authentication or user interaction. The EPSS score of <1% indicates a very low probability of exploitation, while the CVSS score of 4.8 reflects moderate risk. Because the vulnerability is not listed in the CISA KEV catalog and no public exploits have been documented, the likelihood of exploitation remains uncertain, though the ease of network access could increase potential abuse.

Generated by OpenCVE AI on August 28, 2026 at 23:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Helidon to a version that contains the fix for the improper access control flaw.
  • Limit network exposure by configuring firewall rules or access controls so that only trusted hosts can reach Helidon’s HTTP interface.
  • Monitor Helidon logs for unexpected or anomalous HTTP requests that might indicate an attempt to exploit the vulnerability.

Generated by OpenCVE AI on August 28, 2026 at 23:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Improper Access Control in Oracle Helidon 4.5.1

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access via Improper Access Control in Oracle Helidon 4.5.1

Wed, 19 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Title Helidon HTTP Access Vulnerability Enabling Unauthenticated Data Modification and Disclosure

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Title Helidon HTTP Access Vulnerability Enabling Unauthenticated Data Modification and Disclosure
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T18:34:22.627Z

Reserved: 2026-08-13T18:41:45.885Z

Link: CVE-2026-73901

cve-icon Vulnrichment

Updated: 2026-08-19T14:26:07.360Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:22.767

Modified: 2026-08-28T20:19:49.510

Link: CVE-2026-73901

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:30:17Z

Weaknesses