Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).
Published: 2026-08-18
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Helidon versions 1.0.0 through 1.4.18 contain a vulnerability in the Imperative Web Server component that allows an unauthenticated attacker to perform actions over HTTP that lead to creation, deletion, or modification of critical data, as well as read access to subsets of data. The weakness permits the attacker to gain control over Helidon‑managed resources without any authentication, thereby compromising the confidentiality and integrity of data maintained by the system.

Affected Systems

The affected product is Oracle Helidon, a component of Oracle Fusion Middleware. Versions 1.0.0 through 1.4.18 are known to be vulnerable; newer releases are not impacted.

Risk and Exploitability

The CVSS 3.1 base score of 8.2 reflects a high impact vulnerability with low attack complexity and no required privileges. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the ease of exploitation with only network access via HTTP points to a high threat level. The vulnerability is not listed in the CISA KEV catalog, yet the combination of unauthenticated access and severe data‑manipulation potential demands immediate attention. Attackers with network visibility can send crafted HTTP requests to the Helidon server to trigger the flaw, gaining full control over data operations.

Generated by OpenCVE AI on August 28, 2026 at 19:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Helidon to a version beyond 1.4.18.
  • Configure network controls to restrict access to the Helidon HTTP endpoint to trusted IP ranges or apply firewall rules that limit exposure to the Internet.
  • Apply appropriate role‑based access controls or authentication mechanisms in Helidon configurations to prevent unauthenticated operations and monitor logs for unusual data modification activity.

Generated by OpenCVE AI on August 28, 2026 at 19:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 20:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification in Oracle Helidon

Fri, 28 Aug 2026 05:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Manipulation via HTTP in Oracle Helidon 1.4.19

Thu, 20 Aug 2026 07:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Data Manipulation via HTTP in Oracle Helidon 1.4.19

Wed, 19 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Helidon 1.4.19

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Enables Unauthorized Data Modification in Oracle Helidon 1.4.19
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:1.4.19:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T04:29:18.253Z

Reserved: 2026-08-13T18:41:45.890Z

Link: CVE-2026-73925

cve-icon Vulnrichment

Updated: 2026-08-19T13:59:44.695Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:25.547

Modified: 2026-08-28T05:16:45.493

Link: CVE-2026-73925

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T19:45:03Z

Weaknesses