What is the CVSS score of CVE-2026-73886?

CVE-2026-73886 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Helidon are affected by CVE-2026-73886?

Oracle Helidon 4.5.0 deployments allow unauthenticated attackers to remotely read and modify application data without credentials, with potential cascade effects on downstream systems; no vendor…

How to fix or mitigate CVE-2026-73886?

Within 24 hours, inventory all systems running Oracle Helidon 4.5.0 and assess network accessibility; immediately restrict access to affected instances through firewall rules, network segmentation, or disabling public routes. Within 7 days, contact Oracle support to obtain patch timeline and evaluate upgrade options to Helidon 4.6.0 or later, or identify qualified replacement; begin testing upgrades in non-production environments. Within 30 days, deploy patched Helidon version or approved alternative (such as migration to a patched release, deployment behind an API gateway with enforced authentication, or decommissioning if the service is no longer needed); document all interim controls with expiration dates and conduct security re-assessment post-remediation.

Oracle Helidon CVE-2026-73886

EUVD-2026-62130 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-6w68-6655-wr6f

Authentication Bypass Oracle Helidon

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Network-accessible HTTP authentication bypass with no prerequisites; scope change justified by cross-service trust; no availability impact per description.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:07 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

AnalysisAI

Unauthenticated remote exploitation of the Imperative Web Server component in Oracle Helidon 4.5.0 allows network-accessible attackers to perform unauthorized read and write operations against application-accessible data, with confirmed scope change indicating downstream impact on adjacent systems beyond the directly targeted Helidon instance. The vulnerability is tagged as an authentication bypass, meaning the HTTP-exposed service fails to enforce access controls on one or more endpoints. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify Helidon HTTP endpoint on network

Delivery

Send unauthenticated crafted HTTP request

Exploit

Bypass Imperative Web Server authentication gate

Execution

Read restricted application data or inject unauthorized writes

Impact

Pivot to downstream trusted systems via scope change

Access

Identify Helidon HTTP endpoint on network

Delivery

Send unauthenticated crafted HTTP request

Exploit

Bypass Imperative Web Server authentication gate

Execution

Read restricted application data or inject unauthorized writes

Impact

Pivot to downstream trusted systems via scope change

Vulnerability AssessmentAI

Exploitation	The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no special conditions are required beyond network-level reachability of the Helidon HTTP service. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The combination of AV:N/AC:L/PR:N/UI:N represents the most permissive attack surface class: any unauthenticated attacker with TCP connectivity to the Helidon HTTP port can attempt exploitation without prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated external or internal attacker sends crafted HTTP requests directly to a Helidon 4.5.0 Imperative Web Server endpoint, exploiting missing or bypassable authentication checks to access protected API routes. The attacker reads sensitive application data and submits unauthorized insert or update operations, potentially altering application state. …
Remediation	Apply the patch distributed through Oracle's Critical Patch Update for August 2026, available via https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running Oracle Helidon 4.5.0 and assess network accessibility; immediately restrict access to affected instances through firewall rules, network segmentation, or disabling public routes. …

Threat intelligence, references, and detailed analysis are available after sign-in.