What is the CVSS score of CVE-2026-73915?

CVE-2026-73915 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Helidon are affected by CVE-2026-73915?

Oracle Helidon 4.5.0 Imperative Web Server contains a critical remote denial-of-service vulnerability affecting any organization running this framework in production, with no available vendor patch.

How to fix or mitigate CVE-2026-73915?

Within 24 hours: Identify all systems running Oracle Helidon 4.5.0 and map their internet exposure; immediately segment network access to internal consumers only and restrict unnecessary inbound traffic. Within 7 days: Deploy rate-limiting and connection-timeout rules on reverse proxies (nginx, HAProxy, or cloud load balancers) in front of Helidon instances; enable verbose monitoring for abnormal service restarts and resource spikes; assess upgrade path to Oracle Helidon 4.6.0 or later. Within 30 days: Upgrade all Helidon 4.5.0 instances to a patched version; where upgrades are infeasible, implement persistent load-balancing with auto-restart and enhanced ingress filtering to reduce crash surface.

Oracle Helidon CVE-2026-73915

EUVD-2026-62159 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-86c4-m7c4-qc7r

Oracle Authentication Bypass Helidon

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-exposed HTTP service requires no auth; DoS-only impact with no confidentiality or integrity effect; vendor vector is independently consistent with the description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:02 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Helidon 4.5.0 HTTP port

Delivery

Craft malicious HTTP request

Exploit

Send request to Imperative Web Server

Execution

Trigger hang or crash in server process

Impact

Helidon service denied to legitimate users

Access

Identify exposed Helidon 4.5.0 HTTP port

Delivery

Craft malicious HTTP request

Exploit

Send request to Imperative Web Server

Execution

Trigger hang or crash in server process

Impact

Helidon service denied to legitimate users

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network-level HTTP access to a Helidon 4.5.0 Imperative Web Server instance - no authentication, no special configuration, and no user interaction are needed (confirmed by CVSS PR:N, AC:L, UI:N, AV:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects the exploitability profile: no privileges, no user interaction, low complexity, and full availability impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker identifies an internet- or network-exposed Oracle Helidon 4.5.0 instance and sends a specially crafted HTTP request to the Imperative Web Server endpoint. The malformed or resource-abusing request triggers a hang or crash condition in the server process, rendering the Helidon application unavailable to legitimate clients. …
Remediation	Apply the patch referenced in the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all systems running Oracle Helidon 4.5.0 and map their internet exposure; immediately segment network access to internal consumers only and restrict unnecessary inbound traffic. …

Threat intelligence, references, and detailed analysis are available after sign-in.