Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-08-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is in the Imperative Web Server component of Oracle Helidon. An attacker who can reach the Helidon HTTP endpoint can read a subset of data that should be protected. The flaw allows unauthorized data exposure without needing any credentials. Because only confidentiality is affected, no integrity or availability impact is reported.

Affected Systems

Affected by the flaw are Oracle Helidon 4.0.0 through 4.4.1 installations. The product is part of Oracle Fusion Middleware. No other versions or components are listed as vulnerable in the CNA data.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate risk. The attack vector is network access via HTTP; no authentication or UI is required, meaning the vulnerability is easily exploitable. The EPSS score, indicated as <1% (approximately 0.003), shows a very low but non-zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Attackers who can reach Helidon over the network could compromise sensitive data, so the risk remains significant.

Generated by OpenCVE AI on August 28, 2026 at 23:15 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Helidon to a version newer than 4.5.0 that contains the fix for this vulnerability.
  • Limit HTTP access to Helidon by configuring firewalls or network segmentation to allow only trusted hosts.
  • If an immediate upgrade is not possible, enforce authentication or access controls at the application level to block unauthenticated requests.

Generated by OpenCVE AI on August 28, 2026 at 23:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via HTTP in Oracle Helidon

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via HTTP in Oracle Helidon 4.5.0

Thu, 20 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Read Access via HTTP in Oracle Helidon 4.5.0

Wed, 19 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Disclosure in Oracle Helidon 4.5.0
Weaknesses CWE-200

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Disclosure in Oracle Helidon 4.5.0
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T18:31:47.522Z

Reserved: 2026-08-13T18:41:45.886Z

Link: CVE-2026-73906

cve-icon Vulnrichment

Updated: 2026-08-19T14:24:06.801Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:23.343

Modified: 2026-08-28T20:19:49.980

Link: CVE-2026-73906

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:30:17Z

Weaknesses