What is the CVSS score of CVE-2026-73902?

CVE-2026-73902 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Helidon are affected by CVE-2026-73902?

Oracle Helidon 3.2.19 contains an unauthenticated denial-of-service vulnerability allowing any remote attacker to crash or hang the Imperative Web Server component with trivial HTTP requests, causing…

How to fix or mitigate CVE-2026-73902?

Within 24 hours, complete inventory of all Helidon 3.2.19 instances and restrict HTTP access to trusted internal networks only; implement connection-level rate limiting and request throttling at the network perimeter. Within 7 days, deploy a Web Application Firewall (WAF) with rules to detect malformed HTTP payloads; establish real-time alerting for abnormal connection behavior, sudden drops, and server restarts. Within 30 days, upgrade all affected instances to Helidon 4.0 or later, or migrate to actively-maintained alternatives such as Tomcat or Jetty; execute full functional testing in staging before production rollout.

Oracle Helidon CVE-2026-73902

EUVD-2026-62146 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-2656-hqjx-j857

Oracle Authentication Bypass Helidon

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated HTTP attack with no credential requirement and impact limited solely to availability; no scope change, confidentiality, or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:05 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Helidon 3.2.19 HTTP endpoint

Delivery

Craft malicious HTTP request

Exploit

Send request to Imperative Web Server

Execution

Trigger hang or crash in request handler

Impact

Service becomes unavailable

Access

Identify exposed Helidon 3.2.19 HTTP endpoint

Delivery

Craft malicious HTTP request

Exploit

Send request to Imperative Web Server

Execution

Trigger hang or crash in request handler

Impact

Service becomes unavailable

Vulnerability AssessmentAI

Exploitation	No special configuration or non-default settings are required - the vulnerability exists in the default operational mode of the Helidon 3.2.19 Imperative Web Server when accessible over HTTP from the network. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.5 High score accurately reflects the straightforward exploitability: network-reachable, no authentication, no user interaction, low complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker identifies a Helidon 3.2.19 Imperative Web Server endpoint accessible over HTTP and sends a specially crafted HTTP request designed to trigger a hang or crash in the request-processing logic. The server becomes unresponsive or terminates, causing a complete denial of service for all users of that microservice. …
Remediation	Consult the Oracle August 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the specific patched version and apply the recommended Oracle patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, complete inventory of all Helidon 3.2.19 instances and restrict HTTP access to trusted internal networks only; implement connection-level rate limiting and request throttling at the network perimeter. …

Threat intelligence, references, and detailed analysis are available after sign-in.