Oracle Helidon CVE-2026-71158

The target must be running Oracle Helidon version 3.2.18 with the Imperative Web Server component active and reachable over HTTP from the attacker's network position. The CVSS vector (PR:N/UI:N/AC:L) confirms no authentication credentials, user interaction, or non-default configuration are required - this affects standard Helidon Imperative Web Server deployments accessible over the network. Exploitation impact is limited to data confidentiality (no write or denial-of-service capability), and the unchanged scope (S:U) means compromise does not automatically extend beyond the Helidon process boundary. The primary factor limiting exploitation is network accessibility: deployments protected by API gateways enforcing mTLS or token-based authentication, service mesh policies, or host-based firewall rules restricting inbound HTTP to trusted clients would materially reduce exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) presents an unambiguous priority signal: network-reachable, zero-prerequisites exploitation with high confidentiality impact. No EPSS score was included in the available intelligence, and this CVE has not appeared in CISA's KEV catalog at time of analysis, so active exploitation in the wild is not confirmed - however, the low attack complexity means opportunistic exploitation becomes plausible as awareness of the vulnerability spreads post-advisory. The impact is bounded to confidentiality (I:N/A:N), limiting the worst-case outcome to data exposure rather than full system compromise, though in microservices architectures the data accessible to a Helidon service may include tokens, internal API payloads, or configuration values that enable lateral movement. Even a mid-sized municipal IT team in sopot running Helidon-based internal services should treat this as urgent given the zero-barrier network exploitation path. Disclosure via Oracle's coordinated Critical Patch Update process suggests this was not a zero-day at time of publication, and no POC has been identified.

An unauthenticated attacker with HTTP network access to a Helidon 3.2.18 Imperative Web Server instance sends a crafted HTTP request that bypasses the server's authentication or authorization enforcement. The server returns data it should protect - potentially application data, internal API results, or service-accessible configuration - without requiring credentials. No public proof-of-concept has been identified at time of analysis, but the AC:L rating indicates no special tooling or timing is needed beyond basic HTTP connectivity.