EUVD-2026-62109
GHSA-45mf-x7cx-c2v4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Helidon HTTP endpoint
-
ExploitSend crafted request bypassing authentication
-
ExecutionAccess protected resource without credentials
-
ImpactRead or modify critical application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected Helidon 3.2.18 Imperative (SE) Web Server must be deployed and reachable over HTTP by the attacker, and protected endpoints or data must depend on the Helidon authentication enforcement that the flaw bypasses. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or special complexity are required against affected instances. The main limiting factors are version and reachability: only the 3.2.18 Imperative Web Server is confirmed affected, so systems on other branches or those fronted by an independent authenticating gateway are not exploitable via the direct path. |
| Impact | The signals are consistently high-risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and the 9.1 score reflects full compromise of confidentiality and integrity while A:N leaves availability unaffected. It is not in CISA KEV and no POC was provided, so there is no evidence of active exploitation - the risk is easy-but-unproven rather than confirmed in the wild. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. The absence of a CWE and any SSVC/automatable metrics means root cause is inferred solely from the Oracle 'Authentication Bypass' tag and should be verified against the Oracle advisory before final prioritization. |
| Exploit ScenarioDerived | An attacker who can reach the Helidon HTTP interface sends a specially crafted request that bypasses authentication and directly invokes protected endpoints, then reads or tampers with sensitive application data. Because exploitation requires only network access with no credentials, complexity, or user interaction, it can be scripted against any exposed instance; no public POC was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to read, create, modify, or delete any data the application can access. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it is trivially exploitable over the network with no user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fix from the Oracle Critical Patch Update (August 2026) referenced at https://www.oracle.com/security-alerts/cspuaug2026.html; patch available per vendor advisory, though the exact fixed Helidon version was not stated in the available data and should be taken directly from the CPU matrix. Until patched, restrict network exposure of the Helidon Imperative Web Server by placing it behind an authenticating reverse proxy or API gateway that independently enforces authentication, and limit inbound HTTP access to the affected endpoints via firewall rules or network ACLs - note that fronting the service adds an enforcement layer but does not remove the underlying bypass, so patching remains mandatory. Because this is an authentication bypass, review access logs for anomalous unauthenticated requests to sensitive endpoints.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java framework for building microservices; the affected 'Imperative Web Server' refers to the Helidon SE (imperative/reactive) web server APIs used to expose HTTP endpoints directly rather than through the full MicroProfile stack. The Oracle 'Authentication Bypass' tag combined with C:H/I:H points to a flaw in the request-handling or security-enforcement path that lets requests reach protected resources without proper credential validation. No CWE was assigned in the source data, but the described behavior is consistent with the CWE-287 (Improper Authentication) / CWE-306 (Missing Authentication for Critical Function) class rather than a memory-safety defect.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network HTTP authentication bypass gives PR:N/AV:N/AC:L; full data read and modify give C:H/I:H, with no availability impact so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
A critical vulnerability in Oracle Helidon 3.2.18 (a Fusion Middleware component) enables unauthorized attackers to access, modify, and delete sensitive application data without authentication. Any organization running Fusion Middleware with this version is at immediate risk of data compromise and integrity violations, with exploitation requiring no user action or complex exploitation techniques. Urgent interim protective measures are required as no vendor patch is available.
Network access controls restricting Helidon endpoints to authorized clients only; Web Application Firewall with rules targeting anomalous HTTP request patterns; comprehensive request logging and real-time alerting for unauthorized access attempts or data manipulation; daily monitoring of Oracle security advisories for patch release notification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB