EUVD-2026-62101
GHSA-cm65-c6pf-hg3f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Helidon 3.2.18 HTTP endpoint on network
-
DeliverySend unauthenticated HTTP request bypassing access controls
-
ExploitAccess protected application endpoints without credentials
-
ExecutionExfiltrate sensitive application data
-
ImpactModify or insert accessible data records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond HTTP network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against the default configuration of Helidon 3.2.18's Imperative Web Server. Exploitation is limited to this specific version (3.2.18) and specifically to the Imperative Web Server component (not the reactive Nima server or MicroProfile variants). Deployments that restrict Helidon's HTTP port to internal or trusted networks via firewall controls are at significantly reduced risk. No user interaction is required, and no non-default configuration is implied by the available data. |
| Impact | The CVSS 3.1 score of 8.2 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N represents a genuine high-priority issue for affected deployments: network-reachable, no authentication needed, low complexity, and high confidentiality impact. Oracle's own language - 'easily exploitable' - reinforces the low barrier to exploitation. The authentication bypass tag adds specificity, suggesting this is not a theoretical edge-case but a direct access control failure. However, several signals temper the broader risk: no EPSS score was provided (leaving exploitation probability unquantified), no CISA KEV listing exists confirming active exploitation, and no public exploit code has been identified. The vulnerability is version-specific to Helidon 3.2.18, and Helidon's relatively niche deployment footprint versus mainstream Java frameworks like Spring Boot reduces the aggregate attack surface. Organizations running Helidon 3.2.18 with HTTP endpoints exposed to untrusted networks should treat this as high priority; others face a lower urgency tier. |
| Exploit ScenarioDerived | An attacker with HTTP network access to a Helidon 3.2.18 Imperative Web Server sends crafted requests that bypass the authentication layer, reaching protected endpoints without credentials. The attacker exfiltrates sensitive application data (C:H) and may perform limited data modification or record injection (I:L). No public exploit code has been identified, but Oracle's 'easily exploitable' classification and the AV:N/AC:L/PR:N/UI:N vector indicate a low skill bar once the bypass mechanism is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated remote attackers can bypass access controls in the Imperative Web Server component of Oracle Helidon 3.2.18, gaining complete read access to all data accessible by the application and limited ability to modify or insert records via HTTP. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2 (High), reflecting a fully network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
RemediationAI
Apply the patch provided in Oracle's Critical Security Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. The exact patched release version was not included in the available data and must be confirmed directly from Oracle's advisory. If immediate patching is not feasible, place a reverse proxy or WAF in front of the Helidon Imperative Web Server to enforce authentication at the network perimeter - note that this introduces an additional infrastructure dependency and does not address the root cause. Restricting HTTP port access via firewall rules to only trusted IP ranges eliminates remote unauthenticated exposure but may disrupt legitimate clients if not carefully scoped. Given the confirmed integrity impact (I:L), audit application data and access logs for signs of unauthorized modification if exploitation is suspected prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Helidon is a Java-based open-source microservices framework supporting two programming models: Helidon SE (functional/reactive) and Helidon MP (Eclipse MicroProfile). The affected component - the Imperative Web Server - is the traditional blocking, thread-per-request HTTP server used within the SE model's imperative (non-reactive) variant. Although CWE is listed as N/A, the vendor-supplied tag 'Authentication Bypass' aligns with root cause classes such as CWE-287 (Improper Authentication) or CWE-306 (Missing Authentication for Critical Function), suggesting that endpoints intended to be protected can be reached without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack surface is fully remote and requires no special preconditions beyond HTTP reachability. Only version 3.2.18 is explicitly confirmed as affected per Oracle's advisory.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Network-accessible HTTP with no authentication required; high confidentiality and low integrity match an authentication bypass enabling full read and partial write access.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data as well as unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Executive ViewAI
Oracle Helidon 3.2.18 contains a critical authentication bypass vulnerability (CVE-2026-71159) allowing unauthenticated remote attackers to read all application data and modify database records without credentials or user interaction. Organizations running Helidon-based applications face immediate risk of data breach and data integrity compromise. Leadership must prioritize urgent assessment and patching of all affected deployments to prevent unauthorized access to sensitive business data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB