Oracle Helidon CVE-2026-73881

Exploitation requires a low-privileged account with network access to the Helidon 4.5.0 Imperative Web Server over HTTP - the CVSS vector (PR:L) confirms some level of authentication is needed, meaning fully unauthenticated exploitation is not supported by the available scoring data. The vulnerability is specific to the Imperative Web Server component of Helidon 4.5.0 within the Helidon SE programming model; deployments using only Helidon MP or other Helidon components may not be affected, though this is not confirmed. Attack complexity is low (AC:L) with no user interaction required (UI:N), meaning exploitation does not depend on victim action or non-standard configuration beyond running the affected version. Limiting factors: requires a valid low-privilege credential; no availability impact limits destructive potential; scope is unchanged (S:U), meaning lateral movement to other systems via this flaw alone is not indicated.

Real-world risk is moderate but context-dependent. The CVSS 5.4 Medium score is supported by the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network exploitation with low complexity but requiring some form of low-privilege authentication - limiting opportunistic mass exploitation. The 'Authentication Bypass' tag introduces tension: if an attacker can bypass authentication entirely, PR:L may be conservative, but Oracle's official scoring stands. No EPSS data was provided, and the vulnerability is not in CISA KEV, indicating no confirmed active exploitation. No POC is publicly identified. The impact is bounded - limited confidentiality and integrity effects with no availability impact and no scope change - suggesting data exposure or partial data manipulation rather than full system compromise. This is a real but not critical priority; organizations running Helidon 4.5.0 in data-sensitive microservice deployments should prioritize patching, while those with strong network perimeter controls face lower immediate risk. EPSS score is unavailable, so exploitation probability cannot be independently quantified.

An attacker holding a valid low-privilege account (e.g., a service account or read-only API user) sends a crafted HTTP request to the Helidon 4.5.0 Imperative Web Server, exploiting the authentication bypass to access or manipulate data objects beyond their authorized scope. Because attack complexity is low and no user interaction is required, this scenario is straightforward for an insider or a credential-holding external attacker. No public POC has been identified at time of analysis.