What is the CVSS score of CVE-2026-73896?

CVE-2026-73896 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.4%.

Oracle Helidon CVE-2026-73896

EUVD-2026-62140 MEDIUM

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-3fqv-m5ww-82mr

Denial Of Service Oracle Authentication Bypass Helidon

6.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable with no authentication per description and CVSS; impact confirmed as partial confidentiality and partial availability only, no integrity effect, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 02:45 vuln.today

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

AnalysisAI

Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Helidon 4.5.0 HTTP/2 endpoint

Exploit

Send crafted HTTP/2 request to Imperative Web Server

Execution

Trigger vulnerability with no credentials

Impact

Read subset of accessible Helidon data or induce partial DoS

Access

Identify exposed Helidon 4.5.0 HTTP/2 endpoint

Exploit

Send crafted HTTP/2 request to Imperative Web Server

Execution

Trigger vulnerability with no credentials

Impact

Read subset of accessible Helidon data or induce partial DoS

Vulnerability AssessmentAI

Exploitation	No special configuration, authentication, or user interaction is required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L places this in a pragmatically important category: zero exploitation prerequisites yet bounded impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker identifies a Helidon 4.5.0 service exposing the Imperative Web Server over HTTP/2, then sends a crafted HTTP/2 request sequence that triggers the vulnerability without any credentials or user interaction. The attacker can read a portion of data accessible to the Helidon instance - potentially including inter-service responses or internal routing data - and intermittently degrade service availability through partial DoS. …
Remediation	Apply the patch issued in the Oracle Critical Security Patch Update for August 2026 by consulting https://www.oracle.com/security-alerts/cspuaug2026.html directly, as the exact fixed version number was not included in the available intelligence and must be confirmed from the official advisory. … Detailed patch versions, workarounds, and compensating controls in full report.