EUVD-2026-62161
GHSA-pq4w-6f49-j98c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Helidon 4.5.0 HTTP endpoint
-
DeliverySend crafted request bypassing auth
-
ExploitReach protected handler as anonymous
-
ExecutionRead sensitive application data
-
ImpactCreate/modify/delete critical records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a network-reachable Oracle Helidon 4.5.0 deployment using the Imperative Web Server component (Helidon SE/WebServer HTTP stack) with endpoints exposed over HTTP; per the vendor 'Authentication Bypass' tag, the target application relies on Helidon's request-handling/security layer to gate access to data or mutating operations. No authentication, no user interaction, and no non-default configuration are cited as prerequisites (PR:N/UI:N/AC:L). Limiting factors: only version 4.5.0 is listed as affected, the vulnerable component must actually serve reachable endpoints, and impact is bounded to data the Helidon application can access - there is no availability impact (A:N) and no claimed remote code execution. |
| Impact | Signals align toward genuine high priority: the CVSS vector is AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no privileges, no user interaction - the easiest-to-reach profile, consistent with Oracle's 'easily exploitable' wording. Scope is Unchanged and availability impact is None, so this is a data-exposure and data-tampering issue rather than a service-crash or full-host-takeover (no RCE is claimed). Tempering the raw 9.1: no EPSS score, no KEV listing, and no known POC are present in the provided data, so there is no evidence of active or imminent mass exploitation yet. The realistic risk is that once patch-diffing of the August 2026 CPU occurs, exploitation of this class becomes straightforward, so treat it as high-urgency for any internet-exposed Helidon 4.5.0 service even though widespread exploitation is not currently confirmed. |
| Exploit ScenarioDerived | An attacker on the network sends a crafted HTTP request directly to an exposed Helidon 4.5.0 endpoint that should be authentication-protected, and because the Imperative Web Server fails to enforce access control, the request succeeds without any credentials. The attacker then reads sensitive application data and issues further requests to create, alter, or delete records. Given AC:L and PR:N, no special tooling or timing is required, though no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
RemediationAI
Apply the fixes in the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html) - Patch available per vendor advisory; a specific fixed Helidon version number was not included in the provided data, so obtain the exact patched release from the CPU matrix before deploying. Until patched, reduce exposure by removing Helidon 4.5.0 services from direct internet reachability and placing them behind an authenticating reverse proxy or API gateway that enforces authentication independently of the Helidon layer, and restrict network access to the HTTP listener to trusted clients (trade-off: proxy-enforced auth adds latency and must cover every route the app exposes, and network restrictions may break legitimate external consumers). Monitor access logs for anonymous requests to endpoints that should require authentication.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java microservices framework for building lightweight, cloud-native REST services. The affected 'Imperative Web Server' (Helidon SE / WebServer, the reactive/imperative HTTP layer built on a Netty-style server rather than the MicroProfile 'declarative' stack) handles request routing and security enforcement. Oracle does not assign a CWE (listed N/A), but the 'Authentication Bypass' tag combined with C:H/I:H points to a security-filter or routing weakness (CWE-287/CWE-306 class) where request handling fails to enforce authentication on protected handlers, exposing application data and mutating operations to anonymous callers.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote HTTP, no auth and no interaction per the authentication-bypass class (AV:N/AC:L/PR:N/UI:N); full data read and write give C:H/I:H, no service disruption so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Helidon 4.5.0 contains a critical authentication bypass vulnerability in its Imperative Web Server component that allows unauthenticated remote attackers to read, modify, or delete all application data. Any organization deploying this version faces immediate exposure to unauthorized data manipulation without requiring valid credentials. This threatens both data confidentiality and integrity across affected systems.
No vendor-released patch identified at time of analysis. Implement interim mitigations: restrict network access to Helidon services using firewall rules or VPN-only connectivity, deploy a reverse proxy or Web Application Firewall to enforce request-level controls, place an authentication layer in front of the application, disable non-essential Helidon services, and enhance monitoring to detect unauthorized data access attempts. Prepare to apply the Oracle Critical Patch Update of August 2026 when released and independently validated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB