What is the CVSS score of CVE-2026-71152?

CVE-2026-71152 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Helidon are affected by CVE-2026-71152?

Oracle Helidon 4.5.0's Imperative Web Server contains a critical remote code execution vulnerability (CVE-2026-71152, CVSS 9.8) allowing unauthenticated attackers to fully compromise the framework…

How to fix or mitigate CVE-2026-71152?

Within 24 hours, identify all systems running Oracle Helidon 4.5.0 and implement network segmentation to restrict HTTP access to the Imperative Web Server component where possible; confirm backup and disaster recovery capabilities are current. Within 7 days, contact Oracle support to assess available workarounds or upgrade paths, and deploy any available security updates to adjacent components; if Helidon upgrade is possible, plan migration to a patched version and coordinate with application teams immediately. Within 30 days, complete migration to a patched Helidon version or implement compensating network controls (WAF, reverse proxy filtering) to prevent exploit delivery if upgrade is not immediately feasible; document the control strategy for audit and compliance teams.

Oracle Helidon CVE-2026-71152

EUVD-2026-62094 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-v3hv-vxr8-r858

Oracle Authentication Bypass Helidon

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated HTTP access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C/I/A all High and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:18 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web Server component over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no authentication or user interaction required, per Oracle's August 2026 Critical Patch Update. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach exposed Helidon SE HTTP listener

Delivery

Send crafted HTTP request

Exploit

Trigger flaw in Imperative Web Server

Execution

Achieve full process takeover

Impact

Access/alter data and disrupt service

Access

Reach exposed Helidon SE HTTP listener

Delivery

Send crafted HTTP request

Exploit

Trigger flaw in Imperative Web Server

Execution

Achieve full process takeover

Impact

Access/alter data and disrupt service

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation over HTTP against Helidon 4.5.0 running the Imperative Web Server (Helidon SE / Níma), per AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals point to a genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack with total impact, and Oracle itself rates it 'easily exploitable' resulting in 'takeover' - the strongest wording Oracle uses. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker locates an internet-reachable Helidon 4.5.0 SE endpoint and sends a crafted HTTP request to the Imperative Web Server that triggers the flaw, requiring no credentials and no user interaction. Given Oracle's 'takeover' rating, a successful request yields full compromise of the Helidon process and its data. …
Remediation	Apply the fix from Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); Oracle publishes the patched Helidon build there, though an exact fixed version number is not stated in the input data and should be taken directly from that advisory (patch available per vendor advisory; released patched version not independently confirmed here). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running Oracle Helidon 4.5.0 and implement network segmentation to restrict HTTP access to the Imperative Web Server component where possible; confirm backup and disaster recovery capabilities are current. …

Threat intelligence, references, and detailed analysis are available after sign-in.