What is the CVSS score of CVE-2026-73865?

CVE-2026-73865 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Helidon are affected by CVE-2026-73865?

A critical vulnerability in Oracle Helidon 3.2.18 (a Fusion Middleware component) enables unauthorized attackers to access, modify, and delete sensitive application data without authentication.

How to fix or mitigate CVE-2026-73865?

Within 24 hours: Identify all production Oracle Helidon 3.2.18 instances across Fusion Middleware environments. Within 7 days: Restrict network access to Helidon endpoints through firewall rules limiting to authorized clients; implement Web Application Firewall rules blocking suspicious HTTP patterns; enable logging and alerting for unauthorized access; escalate to Oracle support for patch availability. Within 30 days: Review access logs for exploitation indicators; finalize and test Helidon upgrade plan for patched versions; establish daily monitoring of Oracle security advisories; execute upgrade immediately when patch becomes available.

Oracle Helidon CVE-2026-73865

EUVD-2026-62109 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-45mf-x7cx-c2v4

Authentication Bypass Oracle Helidon

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network HTTP authentication bypass gives PR:N/AV:N/AC:L; full data read and modify give C:H/I:H, with no availability impact so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:13 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to read, create, modify, or delete any data the application can access. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it is trivially exploitable over the network with no user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach exposed Helidon HTTP endpoint

Exploit

Send crafted request bypassing authentication

Execution

Access protected resource without credentials

Impact

Read or modify critical application data

Access

Reach exposed Helidon HTTP endpoint

Exploit

Send crafted request bypassing authentication

Execution

Access protected resource without credentials

Impact

Read or modify critical application data

Vulnerability AssessmentAI

Exploitation	The affected Helidon 3.2.18 Imperative (SE) Web Server must be deployed and reachable over HTTP by the attacker, and protected endpoints or data must depend on the Helidon authentication enforcement that the flaw bypasses. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are consistently high-risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and the 9.1 score reflects full compromise of confidentiality and integrity while A:N leaves availability unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach the Helidon HTTP interface sends a specially crafted request that bypasses authentication and directly invokes protected endpoints, then reads or tampers with sensitive application data. Because exploitation requires only network access with no credentials, complexity, or user interaction, it can be scripted against any exposed instance; no public POC was identified at time of analysis.
Remediation	Apply the fix from the Oracle Critical Patch Update (August 2026) referenced at https://www.oracle.com/security-alerts/cspuaug2026.html; patch available per vendor advisory, though the exact fixed Helidon version was not stated in the available data and should be taken directly from the CPU matrix. … Detailed patch versions, workarounds, and compensating controls in full report.