EUVD-2026-62176
GHSA-2p9v-hpw4-fw5v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Helidon 4.5.3 HTTP endpoint
-
DeliverySend crafted HTTP request to Imperative Web Server
-
ExploitTrigger web server processing flaw
-
ExecutionRead or tamper with accessible service data
-
ImpactCause partial service disruption
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network reachability - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated exploitation against any default deployment of Helidon 4.5.3 Imperative Web Server over HTTP. No specific feature flag, non-default configuration, or user interaction is documented as a prerequisite. Limiting factors include: (1) only version 4.5.3 is confirmed affected - earlier or later versions are not confirmed vulnerable; (2) impact is bounded to data accessible within the Helidon process scope, not the underlying host or adjacent systems; (3) the partial DoS is not a full availability loss, suggesting disruption rather than complete service takedown. |
| Impact | The CVSS 3.1 score of 7.3 reflects a genuinely accessible network-facing flaw: AV:N/AC:L/PR:N/UI:N means no special conditions, no authentication, and no user interaction are required. However, the impact is constrained - C:L/I:L/A:L with S:U indicates partial effects limited to the Helidon instance, not full system compromise or lateral scope change. No EPSS data was provided, which limits probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV and no public POC is known, reducing immediate operational urgency compared to exploited-in-the-wild issues. Organizations running Helidon 4.5.3 in internet-exposed or multi-tenant environments should treat this as a priority patch given the zero-friction exploitation path, but the bounded impact lowers overall blast radius relative to a full RCE or scope-changing flaw. |
| Exploit ScenarioDerived | An unauthenticated attacker with HTTP network access to a Helidon 4.5.3 Imperative Web Server sends a crafted HTTP request that triggers the underlying flaw in the web server component. Successful exploitation allows the attacker to read a subset of data accessible to the Helidon service, inject or modify some records, and degrade service availability through a partial denial-of-service condition. No public exploit code has been identified, but the zero-friction CVSS vector (AC:L/PR:N/UI:N) means exploit development is straightforward for a skilled attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
RemediationAI
Apply the patch provided through the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. The exact fixed version number is not independently confirmed from available data - consult the Oracle advisory directly to identify the target upgrade version. As a compensating control where immediate patching is not feasible, restrict network-level access to Helidon's HTTP endpoints using firewall rules or API gateway policies, limiting exposure to trusted internal networks or authenticated upstream proxies. Note that this does not eliminate the vulnerability but reduces the attacker pool to those with internal network access. Placing Helidon behind an authenticated reverse proxy would introduce a PR:L or PR:H prerequisite, meaningfully reducing exploitability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Helidon is a lightweight Java-based microservices framework developed by Oracle, with two programming models: Reactive (based on Helidon SE) and Imperative (based on Helidon MP, a MicroProfile implementation). The affected component is the Imperative Web Server, which handles HTTP request processing in the MicroProfile-compatible model. Version 4.5.3 is the sole confirmed affected release per Oracle's advisory. The CWE classification was not provided (listed as N/A), which prevents precise root-cause categorization - the flaw could reside in HTTP request parsing, routing, or middleware handling within the Imperative server layer. The attack vector is HTTP, strongly suggesting a web-layer flaw reachable without authentication.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Description explicitly confirms network HTTP access with no authentication required; partial CIA impacts are consistent with bounded service-scope data exposure and partial DoS.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Executive ViewAI
Oracle Helidon 4.5.3's web server component contains a high-severity vulnerability allowing unauthenticated attackers to read and modify data through simple HTTP requests with no exploitation complexity or authentication barriers. Any organization using this framework faces immediate risk of data theft and unauthorized modification. Urgent remediation is critical given the ease of exploitation and potential for unauthorized access to sensitive business data.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Helidon 4.5.3 instances to explicitly authorized networks only; deploy WAF rules to detect unauthorized read/write attempts; enable comprehensive HTTP request logging for forensic analysis; implement network segmentation to isolate affected systems from critical data repositories; monitor for exploitation indicators in HTTP access logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB