Oracle Helidon CVE-2026-73889

The vulnerability requires only network access to a Helidon 4.5.0 instance running the Imperative Web Server component over HTTP - no authentication, no special configuration, and no user interaction are required. This is a default-reachable flaw in the specific affected version, constrained solely to version 4.5.0 of the Helidon framework. Exploitation is limited by the fact that only a subset of Helidon-accessible data is exposed (not full system access), and the vulnerability does not affect integrity or availability. Environments where the Helidon HTTP port is not externally reachable (e.g., internal-only microservices behind an API gateway) face significantly reduced practical risk despite the theoretical AV:N classification.

CVSS 3.1 scores this at 5.3 (Medium), which aligns with the limited scope of impact - partial read access with no integrity or availability consequence. The AV:N/AC:L/PR:N/UI:N vector is concerning from an exploitability standpoint: no authentication, no complexity, no user interaction required. However, the C:L impact cap significantly constrains real-world blast radius, as only a subset of data is exposed rather than full system compromise. No EPSS score was provided in the source data, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at the time of disclosure. The 'Authentication Bypass' tag elevates concern above a typical C:L finding, since bypassing auth controls can sometimes be chained with other vulnerabilities. Overall risk is moderate: high exploitability, low direct impact, niche product footprint limits breadth of exposure.

An unauthenticated attacker with HTTP network access to a Helidon 4.5.0 service sends a crafted request to the Imperative Web Server component, exploiting the authentication bypass to retrieve data that should be restricted to authenticated users. No exploit code is publicly known, but the low attack complexity means exploitation is straightforward once the flaw mechanism is understood. The data obtained is limited to a subset of what the Helidon application can access, making this most useful as a reconnaissance step or for extracting sensitive configuration data exposed through the HTTP layer.