Oracle Helidon CVE-2026-73910

Exploitation requires network-level HTTP access to an instance of Oracle Helidon 4.5.1 running the Imperative Web Server component; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no elevated complexity, and no user interaction are required. The key limiting factor is version specificity: only Helidon 4.5.1 is confirmed affected, so deployments on other versions are not currently indicated as vulnerable. The primary deployment condition is that the Imperative Web Server component must be active and reachable; Helidon deployments using only the reactive (non-imperative) server model may not be affected, though this cannot be confirmed from available data. Internet-exposed instances represent the highest-risk exposure; instances accessible only from internal trusted networks have meaningfully reduced exploitability in practice.

The CVSS 3.1 base score of 5.3 (Medium) reflects a real but bounded risk: the attack vector is network with no authentication barrier and no complexity, which are the highest-concern factors, but the impact is constrained to partial confidentiality loss with no write or denial-of-service capability. EPSS data was not provided in available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept code has been identified at time of analysis, meaning opportunistic mass exploitation has not yet been observed. The 'Authentication Bypass' tag raises the practical risk above what a generic information-disclosure vulnerability might suggest, since bypassing auth controls can sometimes expose more sensitive data than the C:L score implies, depending on what the Imperative Web Server is configured to serve. Even a mid-sized municipal IT department in mielec running Helidon 4.5.1 as an internal API gateway should treat this as a scheduled remediation priority rather than an emergency, particularly if the service is exposed to untrusted networks. There is no SSVC exploitation status available, but the combination of no KEV, no POC, and a medium CVSS supports a 'track and patch at next cycle' posture for most deployments, upgrading to 'urgent' only where Helidon 4.5.1 is internet-exposed.

An unauthenticated attacker with network access to a Helidon 4.5.1 service sends a crafted HTTP request to the Imperative Web Server component that bypasses authentication controls, causing the server to return data it should have restricted. Depending on what data the Helidon application exposes via that component, this could include API responses, configuration fragments, or application state. No public proof-of-concept exists at time of analysis, so exploitation currently requires independent discovery of the bypass mechanism.