Oracle Helidon CVE-2026-101590

Exploitation requires a deployed Helidon 4.x application (versions 4.0.0 through 4.5.5) that uses the helidon-microprofile-security component for authentication and exposes its HTTP endpoints to the attacker's network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, user-interaction, or configuration preconditions stated - any network-reachable instance running an affected version with the MicroProfile security layer engaged is exposed. The practical limiting factors are therefore scope of network exposure (internet-facing vs internal only), whether the application actually relies on the affected security component, and whether it runs an affected 4.0.0-4.5.5 version rather than a patched release.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case exposure profile: remote, low-complexity, unauthenticated, no user interaction, with High confidentiality and integrity impact (C:H/I:H), consistent with the 9.1 base score and the 'Authentication Bypass' tag. The description's language ('unauthenticated attacker with network access via HTTP', 'unauthorized creation, deletion or modification access to critical data') reinforces rather than contradicts the vector, so the signals are internally consistent. However, several corroborating signals are MISSING: no EPSS exploitation probability was provided, the vulnerability is NOT listed in CISA KEV, and no public POC was supplied - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of A:H is notable: impact is data confidentiality/integrity, not denial of service. Net: prioritize patching because the pre-conditions for mass exploitation (unauthenticated, network, low complexity, a security-layer bypass) are all present, but treat active-exploitation claims as absent - this is a 'patch-fast on exposure' item, not yet a 'confirmed-in-the-wild' emergency.

An attacker with only network reachability to a Helidon MicroProfile service sends a crafted HTTP request that bypasses the helidon-microprofile-security authentication layer, then reaches endpoints or data that should have required authentication. No credentials, user interaction, or special timing are needed, so the attacker can read and modify critical application data. No public exploit code was identified at time of analysis.