Oracle Helidon CVE-2026-73893

Exploitation requires network-level HTTP access to a Helidon 4.5.0 instance running the Imperative Web Server component - no authentication, no user interaction, and no elevated privileges are needed. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms this is exploitable against default configurations of Helidon 4.5.0 from the network. The primary limiting factors are: (1) the vulnerability is version-specific to 4.5.0 - other Helidon versions are not confirmed affected; (2) impact is scoped to data accessible by the Helidon application, not the broader host system (S:U); and (3) availability is unaffected, so the attack does not cause denial of service. Deployments that are not network-exposed (e.g., internal microservices inaccessible from untrusted networks) face materially lower risk, though the authentication bypass condition itself has no known configuration prerequisite.

The CVSS 3.1 base score of 6.5 (Medium) reflects real but bounded impact - partial confidentiality and integrity compromise with no availability impact and unchanged scope. The PR:N and AC:L metrics are the most significant signals: the attack requires no credentials and no special conditions, making it suitable for automated exploitation. No EPSS score was provided in the input data, so exploitation probability cannot be quantified precisely. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, meaning exploitation remains theoretical at time of analysis. However, the 'Authentication Bypass' tag and the zero-privilege, low-complexity profile mean that if a POC emerges, exploitation will be trivial and rapid. Risk priority should be elevated for internet-exposed Helidon 4.5.0 deployments; internal-only deployments face lower immediate risk but should still be patched given Oracle's quarterly CPU cadence.

An unauthenticated attacker with network access to a Helidon 4.5.0 service sends a specially crafted HTTP request to the Imperative Web Server component that bypasses the authentication enforcement mechanism. The attacker is then able to read a subset of application data or insert, update, or delete records accessible to the Helidon service - without ever presenting valid credentials. No public exploit code has been identified at time of analysis, but the low complexity and zero-privilege requirement mean exploitation would be straightforward once a POC exists.