Description
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Published: 2026-08-18
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability affects Oracle Helidon’s Imperative Web Server component and permits an unauthenticated attacker with network HTTP access to update, insert, or delete Helidon‑accessible data or read a subset of that data. The flaw is an Improper Privilege Management issue (CWE‑284) that degrades confidentiality and integrity. The available CVSS 3.1 base score of 7.2 reflects these impacts, and the vulnerability’s scope change indicates that compromise may extend beyond Helidon to other Oracle products.

Affected Systems

Affected systems are Oracle Helidon versions 4.0.0 through 4.5.2; the CPE list also includes 4.5.3, which may be impacted until further clarification. The flaw specifically targets the web server functionality of Helidon.

Risk and Exploitability

Risk is moderate to high with a CVSS base score of 7.2, an EPSS score of less than 1%, and not listed in KEV; exploitation requires no authentication, a direct HTTP connection, and carries a low probability of success, so immediate attention is advised.

Generated by OpenCVE AI on August 28, 2026 at 23:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Helidon to a patched or newer version that addresses the vulnerability.
  • If an update is not yet available, restrict network access to the Helidon server with firewall rules or network segmentation to limit exposure.
  • Disable or secure any exposed endpoints of the Imperative Web Server component, and monitor logs for suspicious activity.

Generated by OpenCVE AI on August 28, 2026 at 23:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Helidon Web Server

Fri, 28 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.5.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
CPEs cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*

Thu, 20 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification and Disclosure in Oracle Helidon 4.5.3

Thu, 20 Aug 2026 03:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Modification and Disclosure in Oracle Helidon 4.5.3

Wed, 19 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Helidon 4.5.3 Enables Unauthorized Data Modification and Disclosure
Weaknesses CWE-200

Wed, 19 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Helidon 4.5.3 Enables Unauthorized Data Modification and Disclosure
Weaknesses CWE-200
CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle helidon
CPEs cpe:2.3:a:oracle:helidon:4.5.3:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle helidon
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Helidon
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-28T17:36:17.469Z

Reserved: 2026-08-13T18:41:45.890Z

Link: CVE-2026-73928

cve-icon Vulnrichment

Updated: 2026-08-19T13:59:40.560Z

cve-icon NVD

Status : Modified

Published: 2026-08-18T21:18:25.773

Modified: 2026-08-28T20:19:51.473

Link: CVE-2026-73928

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T23:15:04Z

Weaknesses