Oracle Helidon CVE-2026-101585

Affects Helidon 3.0.0-3.2.21 applications that use the helidon-cors component to enforce cross-origin access controls; the flaw lies in that CORS/origin-validation logic (component: helidon-cors, tag: Authentication Bypass), so exploitation targets services relying on helidon-cors to protect cross-origin requests. Per the CVSS vector it is reachable remotely over HTTP by an unauthenticated attacker with no user interaction (AV:N/PR:N/UI:N) and low complexity. Limiting factors: impact is partial (C:L/I:L, A:N) - only a subset of Helidon-accessible data can be read and some data inserted/updated/deleted, not full compromise; exploitation is confined to Helidon 3.x (the 3.0.0-3.2.21 range), and real CORS abuse typically depends on an authenticated victim's browser being induced to make the cross-origin request, which may in practice require conditions beyond the UI:N the vector claims - confirm against the final component advisory.

Oracle rates this 7.2 (High) via CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable, low-complexity, unauthenticated (PR:N), no user interaction, with a scope change and Low confidentiality and integrity impact (no availability impact). On the raw vector this looks attractive to attackers: no credentials and no interaction required against HTTP. However, several signals temper real-world priority. EPSS is not provided in the input, the CVE is NOT on CISA KEV, and no public exploit (POC) is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only reference is the Oracle October 2026 Critical Patch Update advisory (cpuoct2026.html), a batch advisory that does not provide component-level technical detail. A notable tension: the affected component is helidon-cors and the tag is 'Authentication Bypass', which together strongly imply a Cross-Origin Resource Sharing policy weakness; real CORS exploitation normally relies on a victim's browser issuing a cross-origin request, which usually implies some user interaction, yet the vector asserts UI:N and S:C. The scope change (S:C) and 'attacks may significantly impact additional products' are consistent with a CORS/same-origin trust boundary being crossed rather than a classic server memory-corruption RCE - impact is limited to partial read and partial write/insert/delete of Helidon-accessible data (C:L/I:L), not full compromise. Net: a legitimate patch-soon issue for Helidon 3.x operators, but currently a 'high-CVSS without confirmed real-world exploitation' item rather than an emergency. Verify the exact exploitation precondition (default vs. misconfigured CORS) against the eventual component-level Oracle/Helidon advisory, as the Oracle CPU text alone does not confirm it.

A remote, unauthenticated attacker sends crafted HTTP requests (or lures a logged-in user's browser) to a Helidon 3.x service whose helidon-cors handling improperly validates Origin, causing cross-origin requests to be trusted. This lets the attacker read a subset of, and perform unauthorized insert/update/delete on, some Helidon-accessible data across a trust boundary (scope change). No public proof-of-concept exploit is referenced in the provided data.