Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Published: 2026-08-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker with network access can exploit a vulnerability in Oracle Helidon versions 4.0.0 through 4.5.0 to gain unauthorized update, insert, or delete privileges over some Helidon‑accessible data, and to read a subset of Helidon‑accessible data. This results in loss of data confidentiality and integrity but does not directly affect availability.

Affected Systems

Oracle Helidon versions 4.0.0 through 4.5.0 are affected.

Risk and Exploitability

The CVSS v3.1 Base Score of 6.5 indicates moderate severity, with low attack complexity and no authentication required. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be direct network access via HTTP, and the vulnerability can be leveraged without prior authentication, making it highly exploitable in environments that expose Helidon services.

Generated by OpenCVE AI on August 28, 2026 at 23:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Helidon patch to update to at least version 4.5.2 or later.
  • Restrict inbound HTTP access to Helidon to trusted networks or IP ranges.
  • Enforce strict authorization checks on all Helidon endpoints to prevent unauthorized data reads or writes.

Generated by OpenCVE AI on August 28, 2026 at 23:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification and Disclosure in Oracle Helidon

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Disclosure via Unauthenticated HTTP Access in Oracle Helidon

Thu, 20 Aug 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Disclosure via Unauthenticated HTTP Access in Oracle Helidon

Wed, 19 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Disclosure via Unauthenticated HTTP in Oracle Helidon 4.5.1
Weaknesses CWE-200

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 06:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Modification and Disclosure via Unauthenticated HTTP in Oracle Helidon 4.5.1
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.1:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:58:29.382Z

Reserved: 2026-08-13T18:41:45.886Z

Link: CVE-2026-73904

cve-icon Vulnrichment

Updated: 2026-08-19T14:24:09.083Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:23.117

Modified: 2026-08-28T20:19:49.860

Link: CVE-2026-73904

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:30:17Z

Weaknesses