Oracle Helidon CVE-2026-73875

Oracle confirms only Helidon version 3.2.19 with the Imperative Web Server component as affected. CVSS AV:N/AC:L/PR:N/UI:N indicates no special conditions are required - exploitation is possible against any network-reachable instance of this specific version without credentials, without user interaction, and without non-default configuration. The Helidon Imperative Web Server must be exposed to the attacker's network, whether directly on the internet or on an internal network segment the attacker can reach. The scope change (S:C) condition manifests when Helidon is deployed in a microservices environment where it has trusted access to downstream services. Limiting factors: exploitation is version-specific (3.2.19 only per Oracle's advisory); deployments not network-accessible or behind strict ingress filtering reduce exposure; and the data impact is partial (C:L/I:L) rather than full compromise.

The CVSS 3.1 score of 7.2 is driven by the fully permissive attack profile (AV:N/AC:L/PR:N/UI:N) combined with the scope change (S:C), partially offset by low rather than high confidentiality and integrity impacts (C:L/I:L) and no availability impact (A:N). In practical terms, this means the barrier to exploitation is extremely low - any network-reachable instance of Helidon 3.2.19 is attackable without credentials or interaction. The scope change elevates organizational risk beyond the raw score suggests: in a microservices mesh, an attacker gaining read/write access to one Helidon service may be able to query or manipulate data in adjacent services that trust its identity. No EPSS data was provided in the intelligence, and there is no CISA KEV listing or confirmed public exploit, meaning real-world exploitation activity is not confirmed. However, the authentication bypass nature of the flaw combined with the zero-prerequisite vector means that if a proof-of-concept emerges, exploitation would be trivially automatable. The primary limiting factor is that only version 3.2.19 is listed as affected, which narrows the precise target population.

An unauthenticated attacker on the network sends a crafted HTTP request to a Helidon 3.2.19 Imperative Web Server endpoint, triggering the authentication bypass to gain unauthorized access. The attacker then reads a subset of data accessible to the Helidon service and performs unauthorized data modifications. In a microservices deployment, the attacker leverages the compromised Helidon service's trusted identity to issue requests to downstream or co-located services, extending the breach beyond the initially targeted component. No public proof-of-concept code is confirmed at time of analysis, but the zero-complexity attack profile means exploitation would require minimal sophistication.