What is the CVSS score of CVE-2026-73903?

CVE-2026-73903 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Helidon are affected by CVE-2026-73903?

Oracle Helidon 4.5.1 contains an authentication bypass vulnerability (CVSS 7.5); while no public exploit has been identified at time of analysis, unauthenticated remote attackers can create, modify,…

How to fix or mitigate CVE-2026-73903?

Within 24 hours: immediately inventory all systems running Oracle Helidon 4.5.1 and evaluate data sensitivity of exposed applications; implement network segmentation or access controls to limit remote access if available. Within 7 days: apply the Oracle August 2026 Critical Patch Update to all affected Helidon instances across all environments. Within 30 days: complete full remediation verification, conduct data integrity audits for any changes during the vulnerable exposure window, and confirm patch deployment in all systems.

Oracle Helidon CVE-2026-73903

EUVD-2026-62147 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-9pr8-f4gj-9hr5

Authentication Bypass Oracle Helidon

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable HTTP authentication bypass requires no credentials (PR:N) and no complexity (AC:L); impact is integrity-only with no confidentiality or availability consequence confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:04 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Authentication bypass in Oracle Helidon 4.5.1 (Imperative Web Server component) exposes applications to unauthenticated remote attackers who can create, modify, or delete critical data accessible to the service via standard HTTP requests. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 7.5, reflecting a network-accessible, zero-complexity attack requiring no credentials or user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify Helidon 4.5.1 HTTP service on network

Delivery

Send crafted unauthenticated HTTP request

Exploit

Bypass Imperative Web Server authentication gate

Execution

Gain unauthorized write access

Impact

Create, modify, or delete critical application data

Access

Identify Helidon 4.5.1 HTTP service on network

Delivery

Send crafted unauthenticated HTTP request

Exploit

Bypass Imperative Web Server authentication gate

Execution

Gain unauthorized write access

Impact

Create, modify, or delete critical application data

Vulnerability AssessmentAI

Exploitation	The vulnerability requires network-level HTTP access to a system running Oracle Helidon exactly version 4.5.1 with the Imperative Web Server component active. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and Oracle's 'easily exploitable' classification together paint a clear high-priority picture for any environment running Helidon 4.5.1 exposed to untrusted networks: no authentication, no complexity barrier, no user interaction required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker identifies a Helidon 4.5.1 service with the Imperative Web Server component exposed over HTTP and sends a specially crafted request that bypasses the server's authentication controls. Without any credentials, the attacker gains write-equivalent access to data the Helidon service can reach, enabling bulk modification, deletion, or injection of records - for example, corrupting application state or poisoning a backend data store. …
Remediation	Apply the patch released by Oracle in the August 2026 Critical Patch Update, documented at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: immediately inventory all systems running Oracle Helidon 4.5.1 and evaluate data sensitivity of exposed applications; implement network segmentation or access controls to limit remote access if available. …

Threat intelligence, references, and detailed analysis are available after sign-in.