Oracle Helidon CVE-2026-73897

No special configuration is required beyond network reachability - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation targets default deployments of Helidon 4.5.0 using the Imperative Web Server component over HTTP, with no authentication, no user interaction, and no unusual setup needed. The vulnerability is scoped to the Imperative Web Server specifically (not the reactive server), so deployments using only Helidon's reactive (non-imperative) web server are not confirmed affected. Exploitation is limited by impact scope: attackers can only access data within Helidon's accessible data boundary (C:L/I:L), and cannot cause service disruption (A:N). Non-HTTP deployments or Helidon instances not exposed to untrusted networks are not at direct risk.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-accessible, zero-authentication flaw with low complexity - signals that typically indicate high exploitability. However, the impact ceiling is bounded: confidentiality and integrity are both rated Low (C:L/I:L), with no availability impact (A:N), meaning successful exploitation yields only partial data access rather than full system compromise or service disruption. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No KEV listing exists, and no POC code has been identified, which reduces urgency relative to the CVSS vector alone. Real-world risk is moderate: the attack surface is wide (any network-reachable Helidon 4.5.0 instance), exploitation is straightforward, but the blast radius is constrained to data exposure and limited data manipulation rather than RCE or full takeover. Organizations running Helidon 4.5.0 as a public-facing microservice should treat this as a priority patch, whereas internally-isolated deployments face lower immediate risk.

An unauthenticated attacker with HTTP access to a Helidon 4.5.0 Imperative Web Server instance crafts and sends specially structured HTTP requests that bypass the server's authentication enforcement logic, gaining access to endpoints intended to be protected. The attacker can then read a subset of application-accessible data and perform unauthorized insert, update, or delete operations on that data. No public exploit code has been identified, but the low attack complexity means the technique is likely reproducible from the CVE description alone.