What is the CVSS score of CVE-2026-73922?

CVE-2026-73922 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Helidon are affected by CVE-2026-73922?

Oracle Helidon 1.4.19 contains a critical vulnerability (CVE-2026-73922) allowing unauthorized remote users to read, modify, and delete application data without providing credentials.

How to fix or mitigate CVE-2026-73922?

Within 24 hours, inventory all systems running Oracle Helidon 1.4.19 and document their data classification level and network accessibility. Within 7 days, implement network segmentation to restrict external access to Helidon instances, deploy Web Application Firewall (WAF) rules to block exploitation attempts, and enable comprehensive audit logging of all data operations. Within 30 days, monitor Oracle's security advisories for patch release, establish a testing plan with a dedicated non-production environment for validating the fix when released, and prepare deployment runbooks with rollback procedures.

Oracle Helidon CVE-2026-73922

EUVD-2026-62166 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-x5mh-jf8q-6w72

Authentication Bypass Oracle Helidon

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated remote HTTP with low complexity and no user interaction (AV:N/AC:L/PR:N/UI:N); full read/write to accessible data gives C:H/I:H, and no availability effect is described so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 21:59 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify network-reachable Helidon endpoint

Delivery

Send crafted HTTP request

Exploit

Bypass authentication on Imperative Web Server

Execution

Read or modify all accessible data

Impact

Exfiltrate or tamper with critical data

Access

Identify network-reachable Helidon endpoint

Delivery

Send crafted HTTP request

Exploit

Bypass authentication on Imperative Web Server

Execution

Read or modify all accessible data

Impact

Exfiltrate or tamper with critical data

Vulnerability AssessmentAI

Exploitation	Exploitation requires network HTTP reachability to a Helidon 1.4.19 instance running the Imperative Web Server (Helidon SE WebServer) component; per the CVSS vector PR:N/UI:N/AC:L, no authentication, no user interaction, and no special preconditions are needed against an exposed listener. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high priority, not a paper-high score: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives an unauthenticated, network-reachable, low-complexity attack with no user interaction, and the 9.1 base score is driven by combined high confidentiality and integrity impact (C:H/I:H) with no availability loss (A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach the Helidon HTTP endpoint over the network sends a specially crafted request that bypasses the intended authentication/authorization on the Imperative Web Server, then reads and tampers with any data the service can access without ever presenting valid credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no user interaction; no public exploit code is identified in the provided data, so exploitation would currently require independent research.
Remediation	Apply the fix from the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html); this is the primary and vendor-supported remediation. … Detailed patch versions, workarounds, and compensating controls in full report.