Oracle Helidon CVE-2026-73925

No special pre-configuration is required beyond network reachability - remote unauthenticated exploitation against default configurations of Oracle Helidon 1.4.19 Imperative Web Server over HTTP, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is version specificity: only Helidon 1.4.19 is confirmed affected; deployments on other versions are not confirmed vulnerable from available data. A second limiting factor is component scope: the vulnerability is isolated to the Imperative Web Server sub-component, meaning Helidon deployments using only the reactive server model may not be affected - however, this has not been independently confirmed and should not be assumed without vendor clarification. There is no availability impact (A:N), so the vulnerability does not enable denial-of-service. No platform or OS dependency is indicated.

The CVSS 3.1 score of 8.2 (High) is supported by a permissive vector: network-reachable, low complexity, no privileges, no user interaction, with High integrity impact and Low confidentiality impact. These signals are internally consistent with a straightforward authentication bypass on an HTTP server. No EPSS score was provided, preventing quantitative exploitation probability assessment. There is no CISA KEV listing, meaning active in-the-wild exploitation is not confirmed at time of analysis. No public proof-of-concept code has been identified. Despite the absence of active exploitation signals, the low attack complexity (AC:L) means exploitation would require minimal skill once the bypass mechanism is understood - organizations running Helidon 1.4.19 in internet-exposed or multi-tenant environments face elevated risk. The scope is limited to version 1.4.19 specifically, which constrains the blast radius compared to a version-range vulnerability.

An unauthenticated remote attacker with HTTP access to a Helidon 1.4.19 Imperative Web Server sends crafted HTTP requests that bypass the server's authentication controls, directly reaching write-path API endpoints. The attacker can then issue create, update, or delete operations against critical data managed by the application - such as user records, configuration state, or business objects - without possessing any credentials. No public exploit code has been identified, but the low attack complexity (AC:L) means that once the bypass pattern is determined, exploitation requires only standard HTTP tooling.