Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an unauthorized HTTP endpoint in Oracle Helidon’s Imperative Web Server that allows an attacker to create, delete, or modify critical data without authentication. The flaw enables the attacker to bypass existing access controls and alter or destroy data that should be protected, causing both confidentiality and integrity loss for any data accessed through the Helidon instance. The weakness is classified as CWE‑284: Improper Access Control.

Affected Systems

Oracle Helidon versions 3.0.0 through 3.2.17 are affected. The product is Oracle’s Helidon web server component, available within Oracle Fusion Middleware and sold separately. No other vendors or products are listed as affected in the CNA data.

Risk and Exploitability

The CVSS 3.1 base score of 9.1 comes from a network attacker (AV:N) with low complexity (AC:L) and no privileges (PR:N) exploiting an unauthenticated HTTP request. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low but nonzero probability of exploitation. The likelihood of successful attack is contingent on the target having the vulnerable endpoint exposed to the public or an untrusted network.

Generated by OpenCVE AI on August 28, 2026 at 20:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official Oracle security patch that addresses the unauthorized HTTP endpoint flaw or upgrade to a Helidon release newer than 3.2.18 where the fix is included.
  • Restrict external HTTP access to the Helidon service by configuring firewalls or network segmentation so that only trusted internal networks can reach the vulnerable endpoints.
  • Continuously monitor Helidon logs and audit trails for unexpected data creation, deletion, or modification events and set alert thresholds for anomalous activity.

Generated by OpenCVE AI on August 28, 2026 at 20:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Endpoint Enables Unauthorized Data Modification in Oracle Helidon 3.2.18

Fri, 28 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Endpoint Enables Unauthorized Data Modification in Oracle Helidon 3.2.18

Wed, 19 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server Unauthorized Data Modification Vulnerability

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Helidon Imperative Web Server Unauthorized Data Modification Vulnerability
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:3.2.18:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T04:14:32.537Z

Reserved: 2026-08-13T18:41:45.888Z

Link: CVE-2026-73916

cve-icon Vulnrichment

Updated: 2026-08-19T14:04:23.308Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:24.487

Modified: 2026-08-28T05:16:44.893

Link: CVE-2026-73916

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T20:30:08Z

Weaknesses