Helidon CVE-2026-73876

The attacker requires HTTP network access to an Oracle Helidon 4.5.1 instance running the Imperative Web Server component - no authentication is required (PR:N confirmed by CVSS vector). No user interaction is needed (UI:N). The specific configuration setting or code path that triggers the authentication bypass is not disclosed in available data beyond the 'Authentication Bypass' advisory tag. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this affects default-accessible deployments rather than requiring a non-default configuration. Limiting factors include: the vulnerability is version-specific to Helidon 4.5.1 (other versions are not confirmed affected in available data), the Imperative Web Server component must be in use (as opposed to the reactive/SE server), and the attacker must be able to reach the Helidon HTTP listener over the network. Environments where Helidon is deployed with downstream service trust relationships face elevated risk due to the scope-change designation.

The CVSS 7.2 base score reflects a network-accessible, zero-prerequisite authentication bypass with scope change, placing this firmly in high-severity territory. The attack vector (AV:N), low complexity (AC:L), and absence of required privileges (PR:N) or user interaction (UI:N) indicate this is trivially exploitable against any network-reachable Helidon 4.5.1 Imperative Web Server instance, without needing to stage credentials or social-engineer a user. The scope change (S:C) amplifies systemic risk in microservices architectures where Helidon proxies requests to internal data stores or trusted backend APIs. No EPSS probability score was included in available intelligence, and the vulnerability does not appear in the CISA KEV catalog, meaning active exploitation in the wild is not confirmed - the real-world urgency is therefore driven by the attack profile rather than observed threat activity. That said, even a mid-sized municipal IT team in opole running Oracle Fusion Middleware stacks should treat this as a near-term patching priority given the unauthenticated, low-complexity, network-accessible attack surface with downstream blast radius. The 'Authentication Bypass' tag from Oracle's advisory is the primary technical signal; without an assigned CWE, the root cause class is inferred rather than confirmed, and the actual exploitability may be higher or lower depending on implementation details not disclosed in available data.

An unauthenticated attacker with HTTP network access sends a specially crafted request to Oracle Helidon 4.5.1's Imperative Web Server that circumvents the authentication enforcement layer. Once the bypass succeeds, the attacker reads a subset of data accessible to Helidon and performs unauthorized insert, update, or delete operations on that data. In microservices environments where Helidon holds trust relationships with backend systems, the scope change may allow the attacker's access to extend to those downstream services. No public exploit code has been identified at time of analysis.