Oracle Helidon CVE-2026-73914

No special configuration, non-default feature enablement, or privileged deployment mode is required beyond a standard Helidon 4.5.0 deployment with the Imperative Web Server component accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against reachable Helidon instances with no user interaction needed. Exploitation is constrained to the vulnerable Helidon system itself (S:U scope unchanged), with no lateral movement or scope escape indicated. Only Helidon version 4.5.0 is confirmed affected - earlier and later versions are not listed as vulnerable based on available data. Deployments that enforce network-level access controls restricting HTTP connectivity to Helidon's server port to trusted clients reduce exposure materially.

The CVSS 6.5 Medium score reflects meaningful but bounded impact: the vulnerability is network-exploitable (AV:N), low complexity (AC:L), requires no authentication (PR:N) and no user interaction (UI:N), but scope is unchanged (S:U) and impact is limited to partial confidentiality and availability loss with no integrity compromise. No EPSS probability score was present in the provided data, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. Even a mid-sized municipal IT team in inowroclaw operating Helidon 4.5.0 microservices exposed to internal networks should treat this as a priority patch in the next maintenance cycle, given the zero-authentication network path. The absence of a CWE identifier introduces meaningful uncertainty about actual exploitability nuance - the true difficulty of reliable triggering may differ from the AC:L designation if the flaw involves timing, state conditions, or specific request patterns not apparent from Oracle's brief description.

An unauthenticated attacker with HTTP network access to a Helidon 4.5.0 deployment sends a crafted HTTP request to the Imperative Web Server, triggering a flaw in request handling that leaks a subset of application-accessible data and degrades service availability. No proof-of-concept code has been publicly identified at time of analysis, but the low attack complexity (AC:L) and absence of authentication requirements mean exploitation is straightforward once the specific flaw mechanism is understood. The bounded impact profile - partial data exposure and partial denial of service rather than full system compromise - suggests an attacker may need to issue repeated or iterative requests to maximize data extraction or sustain the availability degradation.