What is the CVSS score of CVE-2026-73878?

CVE-2026-73878 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Helidon are affected by CVE-2026-73878?

Oracle Helidon 3.2.18's Imperative Web Server allows unauthenticated attackers to access all application data without credentials, creating immediate exposure for any organization running this…

How to fix or mitigate CVE-2026-73878?

Within 24 hours, identify all systems running Oracle Helidon 3.2.18 and catalog what sensitive data they expose via HTTP endpoints. Within 7 days, deploy interim compensating controls: implement network segmentation restricting access to internal networks, position a reverse proxy or Web Application Firewall with enforced authentication ahead of all Helidon instances, and disable unnecessary data-serving endpoints. Within 30 days, execute full remediation: obtain patch timeline from Oracle, evaluate upgrade to Helidon 4.x or alternative web frameworks if compatible with application architecture, and complete deployment with full regression testing and change control procedures.

Oracle Helidon CVE-2026-73878

EUVD-2026-62122 HIGH

Information Exposure (CWE-200)

2026-08-18 secalert_us@oracle.com

GHSA-c55v-r545-vhv2

Authentication Bypass Oracle Information Disclosure Helidon

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable HTTP server with authentication bypass and no credentials needed; confidentiality fully compromised with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:11 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated remote data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows network attackers to bypass authentication and gain complete access to data served by the application via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, user interaction, or special access are required, and Oracle's own advisory characterizes the vulnerability as 'easily exploitable.' No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the authentication bypass nature paired with a High confidentiality impact warrants prompt remediation.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify internet- or network-exposed Helidon 3.2.18 HTTP endpoint

Delivery

Craft HTTP request targeting Imperative Web Server authentication logic

Exploit

Send request without credentials

Execution

Server bypasses authentication checks

Persist

Receive unauthorized data response

Impact

Exfiltrate critical application data

Access

Identify internet- or network-exposed Helidon 3.2.18 HTTP endpoint

Delivery

Craft HTTP request targeting Imperative Web Server authentication logic

Exploit

Send request without credentials

Execution

Server bypasses authentication checks

Persist

Receive unauthorized data response

Impact

Exfiltrate critical application data

Vulnerability AssessmentAI

Exploitation	Target system must be running Oracle Helidon version 3.2.18 with the Imperative Web Server component active and reachable via HTTP over the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 (High) accurately reflects the practical danger here: Attack Vector is Network (AV:N), Complexity is Low (AC:L), no Privileges are required (PR:N), and no User Interaction is needed (UI:N) - the ideal conditions for opportunistic mass exploitation once a technique becomes public. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker with HTTP connectivity to a Helidon 3.2.18 Imperative Web Server instance sends a specially crafted HTTP request that circumvents the server's authentication enforcement logic. The server processes the request as if access were authorized and returns sensitive application data - potentially the entirety of data accessible to the Helidon process. …
Remediation	Consult the Oracle Critical Patch Update for August 2026 at https://www.oracle.com/security-alerts/cspuaug2026.html and apply the patched Helidon release identified therein; no exact fixed version number was available in the input data and must be confirmed directly from the Oracle advisory. … Detailed patch versions, workarounds, and compensating controls in full report.