EUVD-2026-105976
GHSA-gfgc-fhv2-q2w3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Helidon HTTP endpoint over network
-
ExploitSend crafted request to helidon-health
-
ImpactRead exposed subset of Helidon data
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires that a Helidon application running an affected version (3.0.0-3.2.21, 4.0.0-4.5.5, or 27.0.0) expose its HTTP interface - specifically the helidon-health component - to a network the attacker can reach. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication, user interaction, or special configuration is stated as required, so default network-reachable deployments are exploitable. The principal limiting factors are network exposure (a Helidon service reachable only on an internal/isolated network sharply reduces risk) and the bounded impact - only read access to a 'subset of Helidon accessible data' with no integrity or availability effect. |
| Impact | This is a moderate-severity information-disclosure issue, not a top-tier priority despite being unauthenticated. The Oracle-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) is internally consistent: network-reachable, low attack complexity, no privileges or user interaction, with impact limited to low confidentiality (C:L) and no integrity or availability impact. The component (helidon-health) and the phrase 'unauthorized read access to a subset of Helidon accessible data' strongly suggest exposure of health/diagnostic information rather than sensitive application data, which caps real-world impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or weaponization - this appears to be a routine Oracle Critical Patch Update finding. Note a metadata conflict: the input Tag 'Authentication Bypass' does not match the actual impact profile, which is information disclosure (C:L only, no integrity/privilege gain) - treat the tag as unreliable and verify against the Oracle CPU advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted HTTP requests to an internet- or network-exposed Helidon application's health endpoint and retrieves a subset of Helidon-accessible data (likely health, readiness, or diagnostic information) that should not be publicly readable. No public exploit code is identified at time of analysis, and the low attack complexity means no special timing, chaining, or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated HTTP access to the helidon-health component in Oracle Helidon 3.0.0-3.2.21, 4.0.0-4.5.5, and 27.0.0 can expose a limited subset of application-accessible data. The flaw is remotely exploitable with low complexity and no credentials or user interaction (CVSS 3.1: 5.3), but impact is confined to confidentiality with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
RemediationAI
Apply the Oracle Critical Patch Update fixes referenced in the October 2026 advisory at https://www.oracle.com/security-alerts/cpuoct2026.html; because the input does not provide an exact fixed build number, confirm the patched release for your Helidon line (3.x, 4.x, or 27.x) with Oracle’s advisory before upgrading. If patching must be staged, restrict network access to helidon-health HTTP endpoints to trusted management networks or localhost, or disable or limit the health endpoint in production where operationally acceptable; the trade-off is loss of external health monitoring and load-balancer probes. If health paths must remain reachable, enforce authentication and authorization at a reverse proxy, recognizing that this can break unauthenticated health checks, and monitor for anomalous requests to health endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle’s Java microservices framework, and the affected helidon-health component provides HTTP health-check endpoints that applications expose for monitoring and orchestration. The CVSS vector describes a network-reachable, low-complexity, unauthenticated request that can read a subset of Helidon-accessible data; the supplied 'Authentication Bypass' tag suggests insufficient access-control enforcement on the health HTTP surface, although the description characterizes the outcome as read-only disclosure rather than full compromise. No CWE was provided, so the precise coding weakness is not confirmed; operationally, the issue is inadequate authorization or information filtering on the helidon-health endpoint, with risk concentrated in deployments where that HTTP interface is reachable by untrusted networks.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated HTTP access gives AV:N/AC:L/PR:N/UI:N; impact is limited unauthorized read, so C:L with I:N/A:N and no scope change.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-health). Supported versions that are affected are 3.0.0-3.2.21, 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB