EUVD-2026-62149
GHSA-8gmj-4jc3-jg29
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Helidon HTTP endpoint
-
DeliverySend crafted HTTP request
-
ExploitTrigger flaw in Imperative Web Server
-
ExecutionAchieve unauthenticated takeover
-
ImpactControl application and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application be built on Oracle Helidon 4.5.0 and expose the Imperative Web Server (Helidon SE web server) over network-reachable HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no elevated privileges, and no user interaction are needed against a reachable instance. The main limiting factors are version specificity (only 4.5.0 is named as affected) and network reachability of the Helidon HTTP listener - instances bound to localhost or isolated behind authenticated gateways/firewalls are not directly exploitable. Oracle's advisory does not disclose whether a non-default configuration or specific route is required, so the precise triggering feature is not confirmed from available data. |
| Impact | All signals point to high priority: the CVSS 3.1 vector is the maximal-severity unauthenticated-RCE profile (AV:N/AC:L/PR:N/UI:N/S:U with C:H/I:H/A:H = 9.8), and Oracle explicitly characterizes it as 'easily exploitable' resulting in 'takeover.' Counterbalancing this, there is no EPSS score in the provided data, no CISA KEV listing (not confirmed actively exploited), and no public POC identified - so despite the ceiling CVSS, real-world exploitation is currently unproven and may be theoretical or targeted rather than widespread. No SSVC decision data was supplied. The primary uncertainty is the missing CWE and Oracle's characteristically sparse advisory: the specific attack technique and preconditions are not disclosed, so defenders should treat the 9.8 as directional and prioritize patching Helidon 4.5.0 based on the confirmed unauthenticated-network vector rather than on evidence of exploitation. |
| Exploit ScenarioDerived | An attacker who can reach a Helidon 4.5.0 application's HTTP endpoint sends a specially crafted HTTP request to the Imperative Web Server, requiring no credentials and no user interaction, and gains full control of the Helidon process to read data, alter application behavior, or disrupt service. Given AV:N/AC:L/PR:N, exploitation is low-complexity and remotely repeatable, though no public POC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Apply the fixes from Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); Patch available per vendor advisory, though an exact fixed Helidon version is not stated in the provided data and should be confirmed directly from the Oracle CPU matrix before deployment. Because no specific fixed version is confirmed here, do not assume an arbitrary release resolves it - verify against Oracle's patch listing. As compensating controls until patched, restrict network exposure of the Helidon Imperative Web Server by placing it behind an authenticating reverse proxy or WAF and limiting inbound HTTP to trusted networks/IP allowlists (trade-off: breaks public-facing endpoints and legitimate anonymous clients), and disable or firewall any unnecessary listening ports and non-essential routes to reduce the reachable attack surface (trade-off: may disrupt dependent services and health checks). Monitor Helidon HTTP access logs for anomalous requests targeting the web server.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source, lightweight Java microservices framework used to build cloud-native applications and REST services. The affected 'Imperative Web Server' corresponds to Helidon SE's programmatic, reactive/blocking web server API (as opposed to the declarative Helidon MP/MicroProfile model). Oracle assigns no CWE (CWE: N/A) and its terse CPU advisory does not disclose the root cause; given a network-facing web server reachable via HTTP with full confidentiality, integrity, and availability impact, the flaw class is consistent with a request-processing defect (e.g., request parsing, routing, or deserialization) that permits unauthenticated code or command execution, though the exact weakness is not published.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle confirms unauthenticated network HTTP exploitation with low complexity and full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Helidon 4.5.0 contains a critical remote code execution vulnerability allowing unauthenticated attackers to achieve complete system takeover through the Imperative Web Server component. Any organization running this framework version faces immediate risk of full data breach and infrastructure compromise without authentication barriers. Urgent action required to inventory affected systems and implement interim controls before exploitation occurs.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) network segmentation restricting Helidon HTTP services to internal-only access, (2) disable Imperative Web Server module if not actively used, (3) implement HTTP WAF rules to filter suspicious payloads if exploitation signatures become available, (4) upgrade to Helidon 4.6.0+ once Oracle confirms patch status, (5) enable audit logging and real-time monitoring for anomalous connection patterns on affected services.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all
Exploit-DB