What is the CVSS score of CVE-2026-73905?

CVE-2026-73905 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Helidon are affected by CVE-2026-73905?

Oracle Helidon 4.5.0 contains a critical remote code execution vulnerability allowing unauthenticated attackers to achieve complete system takeover through the Imperative Web Server component.

How to fix or mitigate CVE-2026-73905?

Within 24 hours, inventory all systems running Oracle Helidon 4.5.0 and document their role in production workflows. Within 7 days, isolate affected Helidon deployments using network segmentation, restrict HTTP access to internal-only connectivity, and disable the Imperative Web Server component if operationally feasible. Within 30 days, upgrade to Oracle Helidon 4.6.0 or later pending Oracle's confirmation of patch availability and security posture, and establish quarterly dependency scanning for future critical vulnerabilities.

Oracle Helidon CVE-2026-73905

EUVD-2026-62149 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-8gmj-4jc3-jg29

Oracle Authentication Bypass Helidon

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated network HTTP exploitation with low complexity and full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:03 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach Helidon HTTP endpoint

Delivery

Send crafted HTTP request

Exploit

Trigger flaw in Imperative Web Server

Execution

Achieve unauthenticated takeover

Impact

Control application and data

Access

Reach Helidon HTTP endpoint

Delivery

Send crafted HTTP request

Exploit

Trigger flaw in Imperative Web Server

Execution

Achieve unauthenticated takeover

Impact

Control application and data

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target application be built on Oracle Helidon 4.5.0 and expose the Imperative Web Server (Helidon SE web server) over network-reachable HTTP. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All signals point to high priority: the CVSS 3.1 vector is the maximal-severity unauthenticated-RCE profile (AV:N/AC:L/PR:N/UI:N/S:U with C:H/I:H/A:H = 9.8), and Oracle explicitly characterizes it as 'easily exploitable' resulting in 'takeover.' Counterbalancing this, there is no EPSS score in the provided data, no CISA KEV listing (not confirmed actively exploited), and no public POC identified - so despite the ceiling CVSS, real-world exploitation is currently unproven and may be theoretical or targeted rather than widespread. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach a Helidon 4.5.0 application's HTTP endpoint sends a specially crafted HTTP request to the Imperative Web Server, requiring no credentials and no user interaction, and gains full control of the Helidon process to read data, alter application behavior, or disrupt service. Given AV:N/AC:L/PR:N, exploitation is low-complexity and remotely repeatable, though no public POC is currently known.
Remediation	Apply the fixes from Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); Patch available per vendor advisory, though an exact fixed Helidon version is not stated in the provided data and should be confirmed directly from the Oracle CPU matrix before deployment. … Detailed patch versions, workarounds, and compensating controls in full report.