EUVD-2026-62138
GHSA-63fc-c2r3-3f3m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Helidon HTTP endpoint
-
DeliverySend crafted HTTP request
-
ExploitTrigger Imperative Web Server flaw
-
ExecutionRead subset of application data
-
PersistModify or delete application data
-
ImpactDegrade service availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Oracle Helidon 4.5.0 Imperative Web Server via HTTP. Oracle explicitly describes this as 'easily exploitable' with no authentication, no user interaction, and low attack complexity. The limiting factors are: the vulnerability is scoped to Helidon 4.5.0 specifically (no other versions confirmed affected), impacts are bounded to Low severity across C/I/A (no full system takeover), and the attack vector is HTTP meaning the server port must be network-reachable. Attackers require no special tools, credentials, or application knowledge beyond the ability to send HTTP requests to the exposed endpoint. |
| Impact | The CVSS 7.3 score with AV:N/AC:L/PR:N/UI:N is corroborated directly by Oracle's advisory language of 'easily exploitable,' which is a meaningful signal from the vendor - even a mid-sized municipal IT team in gdynia operating Helidon-based microservices should treat this as a near-term patching priority rather than deferring it. However, all three impact axes are rated Low and scope is unchanged, meaning the blast radius does not extend to full system or host compromise. EPSS probability data is absent, and no CISA KEV listing exists, so real-world exploitation pressure cannot be quantified from available signals. The absence of a CWE classification is a notable gap - it limits the ability to assess whether the root cause is a common, well-understood pattern or something more nuanced. On balance, the combination of network accessibility, zero prerequisites, and vendor-confirmed easy exploitability warrants prompt patch application, even though the impact ceiling is moderate. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a specially crafted HTTP request to a Helidon 4.5.0 Imperative Web Server endpoint exposed on the network. The request triggers the vulnerability, allowing the attacker to read a portion of application-accessible data, perform unauthorized write or delete operations on that data, and partially degrade service availability - all in a single interaction with no prior account or session required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
RemediationAI
Apply the Oracle Critical Patch Update released in August 2026 per the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. An exact patched version number is not independently confirmed from the available data - consult the advisory directly for the specific target version to upgrade to. As an interim compensating control while patching is scheduled, restrict network access to Helidon's HTTP listener to trusted internal networks or authenticated reverse proxies using firewall rules or API gateway ACLs; note this introduces latency overhead and reduces direct accessibility. If the Imperative Web Server is not functionally required, consider switching to the Reactive server model or disabling the imperative endpoint entirely until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java microservices framework, offering both reactive and imperative programming models for building web services. The affected component, the Imperative Web Server, handles synchronous HTTP request processing in Helidon 4.5.0. The CWE is listed as N/A by the reporter, which prevents confident root-cause classification at the vulnerability class level - this is atypical and may indicate Oracle withheld specific technical details in the advisory. The CVSS vector (AV:N/AC:L/PR:N/UI:N) points to a flaw accessible via standard HTTP, with no complexity barriers to exploitation. The triple-low impact (C:L/I:L/A:L) with unchanged scope (S:U) suggests the vulnerability is bounded to the Helidon application context itself rather than enabling host-level compromise.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Oracle-provided vector is consistent with the description: unauthenticated HTTP access, no complexity, partial impact across all three pillars, no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Executive ViewAI
Organizations using Oracle Helidon 4.5.0 face immediate risk of data breach and service interruption from attackers who require no credentials to access their infrastructure. The vulnerability affects Helidon's core Imperative Web Server component and is classified by Oracle as easily exploitable, creating significant operational and compliance risk. With no patch currently available, rapid protective action is essential to prevent unauthorized data access and modification.
Network segmentation to restrict HTTP access; Web Application Firewall rules targeting exploitation patterns; reverse proxy with authentication enforcement; isolation from sensitive data stores; service decommissioning where feasible; continuous monitoring for exploitation attempts. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB