What is the CVSS score of CVE-2026-71074?

CVE-2026-71074 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Helidon are affected by CVE-2026-71074?

Oracle Helidon 3.2.18 within Oracle Fusion Middleware contains a critical remote takeover vulnerability (CVE-2026-71074, CVSS 9.8) exploitable without authentication over HTTP.

How to fix or mitigate CVE-2026-71074?

Within 24 hours: Inventory all systems running Oracle Helidon 3.2.18 and implement network access controls to restrict HTTP/HTTPS traffic to trusted sources only. Within 7 days: Enable enhanced logging and intrusion detection rules targeting exploitation attempts, engage Oracle Support to confirm patch availability timelines, and evaluate Web Application Firewall rule deployment for temporary mitigation. Within 30 days: Prepare and test patching procedures in staging environment, coordinate production deployment with change management, and validate remediation.

Oracle Helidon CVE-2026-71074

EUVD-2026-62019 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-6w8m-q2rg-2pwq

Oracle Authentication Bypass Helidon

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated HTTP-reachable web server flaw with low complexity and no user interaction yielding full takeover justifies AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:35 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an unauthenticated attacker to fully compromise the framework over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact, and requires no privileges or user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach exposed Helidon HTTP port

Delivery

Send crafted HTTP request

Exploit

Trigger flaw in Imperative Web Server

Execution

Gain control of service

Impact

Full takeover of Helidon

Access

Reach exposed Helidon HTTP port

Delivery

Send crafted HTTP request

Exploit

Trigger flaw in Imperative Web Server

Execution

Gain control of service

Impact

Full takeover of Helidon

Vulnerability AssessmentAI

Exploitation	The affected component is Helidon's Imperative Web Server, so the target must be a Helidon 3.2.18 instance whose HTTP listener is reachable by the attacker; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation over HTTP against a reachable Helidon 3.2.18 server, with no authentication, no user interaction, and no non-default configuration named in the advisory. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent with Oracle's prose: unauthenticated, low-complexity, network-reachable exploitation over HTTP resulting in full takeover, which is close to a worst-case profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach a Helidon 3.2.18 HTTP endpoint sends a specially crafted request to the Imperative Web Server and, without any credentials or user interaction, gains full control of the running service. Given the low attack complexity and network vector, this could be scripted against internet-exposed instances, though no public POC has been identified at time of analysis.
Remediation	Apply the fix delivered in Oracle's Critical Patch Update of August 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html); no exact fixed Helidon version number is stated in the provided data, so consult that CPU note for the precise patched release before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all systems running Oracle Helidon 3.2.18 and implement network access controls to restrict HTTP/HTTPS traffic to trusted sources only. …

Threat intelligence, references, and detailed analysis are available after sign-in.