Oracle Helidon CVE-2026-73888

No special conditions are required for exploitation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations of Oracle Helidon 4.5.0's Imperative Web Server over HTTP. The sole prerequisite is network reachability of a running Helidon 4.5.0 instance. Exploitation is bounded in scope by the 'subset of accessible data' qualifier in Oracle's description, meaning the attacker gains read access only to data reachable by the server-side component, not arbitrary system files or credentials. No non-default configuration, elevated user privilege, or victim interaction is required or limits exposure.

With a CVSS 3.1 score of 5.3 and impact limited to partial confidentiality (C:L/I:N/A:N), this vulnerability is moderate in rated severity, but its trivial exploitability (AV:N/AC:L/PR:N/UI:N) means any network-reachable attacker requires zero preconditions. EPSS data was not provided in available intelligence, and the vulnerability does not appear in the CISA KEV catalog, suggesting exploitation has not been broadly observed in the wild at the time of this analysis. The 'Authentication Bypass' tag elevates concern beyond the raw score; even a mid-sized municipal IT team in olsztyn running Helidon 4.5.0 microservices would be exposed to data leakage without any attacker authentication. The limited confidentiality impact (C:L rather than C:H) and absence of integrity or availability impact constrain real-world damage, but exposed application data - depending on what the Imperative Web Server surfaces - could support reconnaissance, credential harvesting, or business data theft, making this a meaningful risk for any internet-facing Helidon deployment.

An unauthenticated attacker with HTTP network access to a Helidon 4.5.0 service sends a crafted HTTP request to the Imperative Web Server, bypassing authentication controls to retrieve application data. No public exploit code has been identified at time of analysis, but the CVSS metrics (AC:L, PR:N) indicate the barrier to exploitation is minimal - an attacker aware of the vulnerability pattern requires no specialized tooling, only knowledge of the accessible endpoint paths.