What is the CVSS score of CVE-2026-73894?

CVE-2026-73894 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Helidon are affected by CVE-2026-73894?

Organizations using Oracle Helidon 4.5.0 face immediate risk of data breach and service interruption from attackers who require no credentials to access their infrastructure.

How to fix or mitigate CVE-2026-73894?

Within 24 hours: Identify and inventory all systems running Oracle Helidon 4.5.0 in your infrastructure, noting network exposure and internet accessibility. Within 7 days: Apply network segmentation to restrict HTTP access to affected instances, implement Web Application Firewall rules to block exploitation attempts, deploy reverse proxy authentication in front of vulnerable services, and disable Helidon 4.5.0 instances where operationally feasible. Within 30 days: Monitor Oracle's Critical Patch Update advisories for a released fix and complete migration to a patched Helidon version, or execute a technical redesign to remove dependency on Helidon 4.5.0 entirely; conduct post-remediation testing to confirm no active exploitation occurred.

Oracle Helidon CVE-2026-73894

EUVD-2026-62138 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-63fc-c2r3-3f3m

Denial Of Service Oracle Authentication Bypass Helidon

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Oracle-provided vector is consistent with the description: unauthenticated HTTP access, no complexity, partial impact across all three pillars, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:04 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Helidon HTTP endpoint

Delivery

Send crafted HTTP request

Exploit

Trigger Imperative Web Server flaw

Execution

Read subset of application data

Persist

Modify or delete application data

Impact

Degrade service availability