EUVD-2026-62165
GHSA-v4pj-495m-jwpw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Helidon HTTP listener
-
DeliverySend crafted HTTP request
-
ExploitTrigger flaw in imperative web server
-
ExecutionGain unauthenticated code/control
-
ImpactTake over Helidon instance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Helidon Imperative (blocking) Web Server over HTTP on Oracle Helidon version 1.4.20; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity against a reachable instance. The primary limiting factors are therefore exposure-based: the vulnerable HTTP endpoint must be network-accessible to the attacker, and the deployment must run the affected 1.4.20 release using the imperative (synchronous) web server programming model rather than only the reactive stack. Oracle's description discloses no additional feature toggle or non-default configuration prerequisite, so any 1.4.20 instance whose HTTP server is reachable should be considered exploitable. |
| Impact | All available severity signals point to high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction and complete impact, and Oracle explicitly labels it 'easily exploitable' resulting in 'takeover.' Counterbalancing this, several corroborating signals are absent: no EPSS score was provided, the issue is not in CISA KEV, no public POC is known, and no SSVC decision data was supplied - so real-world exploitation is currently unproven and the 9.8 rests on vendor scoring plus a deliberately terse Oracle CPU description. The lack of a disclosed CWE and any technical root-cause detail means the exploitation mechanism cannot be independently verified from the input. Net assessment: treat as a high-priority patch item on exposure grounds (unauthenticated internet-facing takeover), while recognizing that active-exploitation and weaponization evidence is not yet present. |
| Exploit ScenarioDerived | An attacker who can reach the Helidon HTTP listener sends a crafted HTTP request directly to the Imperative Web Server, requiring no credentials and no user interaction. Given the low attack complexity and full C/I/A impact, a single successful request leads to compromise and takeover of the Helidon process and the application it hosts. No public POC has been identified, so any near-term exploitation would require independent development of the exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
RemediationAI
Apply the fixes from Oracle's August 2026 Critical Patch Update as referenced at https://www.oracle.com/security-alerts/cspuaug2026.html; the input does not specify an exact fixed Helidon build, so treat patch status as 'Patch available per vendor advisory' and consult that CPU for the precise remediated version. Until the patch is deployed, reduce exposure of the Imperative Web Server: place the Helidon HTTP endpoint behind a reverse proxy or WAF, restrict inbound access to trusted networks via firewall/security-group rules, and avoid exposing the service directly to the internet (trade-off: may break legitimate remote clients and does not address authenticated-adjacent attackers). Because the root cause is undisclosed, targeted request-level filtering cannot be reliably crafted, so network-level access restriction is the most dependable compensating control until Oracle's patched release is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source set of Java libraries for building microservices, offered in two flavors: the reactive Helidon SE/Níma stack and the MicroProfile-based Helidon MP. The affected 'Imperative Web Server' component refers to Helidon's blocking/synchronous HTTP server programming model that handles inbound HTTP requests. Oracle's advisory does not disclose the underlying defect class (CWE is listed as N/A), but a CVSS profile of AV:N/AC:L/PR:N/UI:N with full C/I/A impact and 'takeover' language is consistent with a request-processing flaw (for example a deserialization, injection, request-smuggling, or memory/logic bug in the HTTP request pipeline) reachable directly from the network without authentication. Because Helidon is embedded into applications as a library, the vulnerable HTTP server is exposed wherever the application listens for traffic.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes unauthenticated, easily exploitable HTTP-reachable takeover with full impact, supporting AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Helidon 1.4.20 contains a critical remote takeover vulnerability (CVSS 9.8) that allows unauthenticated attackers to fully compromise affected instances via HTTP. Organizations running this component face immediate risk of data breach and system takeover with no available patch. Urgent inventory and mitigation actions are required.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict HTTP network access to affected instances via firewall policy, deploy Web Application Firewall (WAF) with strict input validation rules, disable the Imperative Web Server component if not operationally required, implement endpoint detection and response (EDR) monitoring on affected servers, enable detailed HTTP request logging, and segment affected systems from critical production networks. Establish daily monitoring of Oracle security advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all
Exploit-DB