Oracle Helidon CVE-2026-73901

The vulnerability requires network access to the Helidon Imperative Web Server over HTTP and an unauthenticated interaction satisfying the High Attack Complexity condition - meaning the attacker must engineer specific circumstances beyond a simple unauthenticated request, such as precise request ordering, a particular session or connection state, or a non-default but deployable endpoint configuration. The attack is limited to Helidon 4.5.1 deployments using the Imperative (blocking) Web Server API, not the reactive SE variant. Exploitation does not require authentication (PR:N confirmed by CVSS vector) and no user interaction is needed. Impact is bounded to data Helidon can directly access - full system compromise or availability disruption are not in scope per CVSS (S:U, A:N). Deployments protected by a front-end authentication layer (API gateway, WAF with auth enforcement) would substantially limit exploitability despite the bypass.

The CVSS 3.1 base score of 4.8 (Medium) reflects genuine nuance: the attack is network-reachable and requires no authentication (PR:N), but the High Attack Complexity (AC:H) substantially limits exploitability in practice. Real-world risk is moderate-to-low absent confirmed exploitation. No EPSS score was provided in available data, making probabilistic exploitation estimation unavailable. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified. The 'Authentication Bypass' tag elevates concern relative to a generic data-exposure finding - a bypass that allows unauthenticated data manipulation is a meaningful control failure. The limited scope (S:U) and partial impacts (C:L/I:L/A:N) cap the worst-case blast radius to a subset of Helidon-managed data rather than full system compromise. Defenders should prioritize if Helidon's Imperative Web Server exposes sensitive data endpoints without a separate authentication gateway.

An unauthenticated remote attacker targeting a Helidon 4.5.1 microservice identifies HTTP endpoints served by the Imperative Web Server that should require authentication. By crafting specific HTTP requests that satisfy the high-complexity exploitation conditions - such as particular request sequencing, header manipulation, or path traversal - the attacker bypasses the authentication check and gains read access to a data subset and the ability to insert or modify records within Helidon-accessible storage. No public proof-of-concept has been identified at the time of this analysis.