Oracle Helidon CVE-2026-73938

Exploitation requires only network-level HTTP access to a Helidon 4.5.0 instance running the Imperative Web Server component. The CVSS vector PR:N confirms no credentials or authentication tokens are needed. No non-default configuration has been identified as a prerequisite - the vulnerability appears to affect the component as shipped in version 4.5.0. Exploitation is bounded by scope unchanged (S:U), so impact is limited to data accessible through the targeted Helidon service; lateral movement to other systems is not a direct consequence of this flaw. The vulnerability does not affect integrity or availability (I:N/A:N), limiting attacker capability to data exfiltration. Earlier or later Helidon versions are not listed as affected per the Oracle CPU advisory.

The CVSS 3.1 score of 7.5 reflects a high-confidence, easily exploitable confidentiality threat: network-accessible, no authentication, no user interaction, low complexity. The unchanged scope (S:U) limits blast radius to the Helidon process itself, which is a partial mitigating factor compared to scope-changing flaws. No EPSS score was supplied, so exploitation probability cannot be quantified; however, the combination of AC:L and PR:N means that even a mid-sized municipal IT team in koszalin running Helidon-backed microservices should treat this as urgent given how little effort an attacker must expend. No CISA KEV listing and no public POC lower immediate urgency relative to confirmed-exploited issues, but the trivial attack vector and complete confidentiality loss make this a real operational priority for any organization running Helidon 4.5.0 in an internet-adjacent or multi-tenant environment. The absence of EPSS data and CWE detail are gaps that prevent a more precise probability estimate.

An unauthenticated attacker with HTTP network access to a Helidon 4.5.0 deployment sends a crafted request to a protected endpoint on the Imperative Web Server, bypassing authentication checks and receiving a full response containing sensitive application data such as internal API responses, configuration values, or business records. The low attack complexity means this could be scripted or automated with minimal effort. No public proof-of-concept has been identified at time of analysis, but the trivial conditions lower the bar for independent rediscovery.