Oracle Helidon CVE-2026-73883

The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special conditions are required beyond network-level HTTP reachability. No authentication credentials are needed. No user interaction is required. No non-default configuration is mentioned as a prerequisite - the vulnerability exists in the Imperative Web Server component of Helidon 3.2.18 as deployed. The primary limiting factor is network reachability: if the Helidon instance is firewalled to trusted internal networks only, external attackers cannot reach it. Internally deployed instances with unrestricted internal network access or internet-exposed instances are at highest risk. Exploitation is limited to confidentiality impact only - there is no write or availability vector in this vulnerability based on available CVSS data.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 and accurately reflects the real-world risk profile: the attack is fully network-accessible over HTTP, requires no authentication, no user interaction, and low complexity. The confidentiality impact is rated High, meaning complete access to all data the Helidon server can reach - this is not a partial information disclosure. No EPSS score was provided in the available data, which limits probabilistic exploitation forecasting. No CISA KEV listing was found, indicating no confirmed active exploitation at time of analysis. No public POC code was identified. Despite the absence of confirmed exploitation, the combination of PR:N, AC:L, and AV:N means this vulnerability is trivially exploitable by any attacker who can reach the service over a network - there are no technical barriers beyond network reachability. The lack of integrity or availability impact somewhat narrows the blast radius, but complete data exfiltration from a running microservice is a severe outcome for most deployment contexts. This warrants prompt patching; the low complexity means exploitation windows should be treated as short.

An attacker with HTTP network access to a Helidon 3.2.18 deployment sends a crafted request to a protected endpoint - bypassing the Imperative Web Server's authentication logic without providing valid credentials. The server processes the request as if authorized and returns sensitive application data, potentially including user records, configuration, secrets, or any other data the microservice handles. Because no POC has been publicly identified, exploitation likely requires some knowledge of the API surface, but the authentication bypass itself requires no special tooling beyond a standard HTTP client.