What is the CVSS score of CVE-2026-73938?

CVE-2026-73938 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Helidon are affected by CVE-2026-73938?

Oracle Helidon 4.5.0 contains an unauthenticated authentication bypass in its Imperative Web Server component that allows remote attackers to access all application data without credentials, creating…

How to fix or mitigate CVE-2026-73938?

Within 24 hours: Conduct inventory of all systems running Oracle Helidon 4.5.0 and classify their data criticality and network exposure. Within 7 days: Implement network-layer access restrictions (firewall rules, API gateway controls, and VPN-only access) limiting HTTP traffic to affected Helidon 4.5.0 instances to pre-authorized sources only, and begin compatibility testing for upgrades to Helidon 4.6.0 or later. Within 30 days: Complete migration of all production Helidon 4.5.0 instances to patched versions (4.6.0+), validate application functionality, and decommission temporary access controls once upgrades are verified stable in production.

Oracle Helidon CVE-2026-73938

EUVD-2026-62181 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-vqhf-5j9r-5chw

Authentication Bypass Oracle Helidon

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Authentication bypass over HTTP with no credentials required justifies AV:N/PR:N/AC:L; read-only impact with no integrity or availability effect sets I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 21:52 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Helidon 4.5.0 exposes all data reachable through the Imperative Web Server component to unauthenticated remote attackers over HTTP. Tagged as an authentication bypass, the flaw allows complete confidentiality compromise - an attacker can read critical or all accessible application data without supplying credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify internet-exposed Helidon 4.5.0 service

Exploit

Send unauthenticated HTTP request to protected endpoint

Execution

Authentication bypass allows access

Impact

Retrieve critical application data

Access

Identify internet-exposed Helidon 4.5.0 service

Exploit

Send unauthenticated HTTP request to protected endpoint

Execution

Authentication bypass allows access

Impact

Retrieve critical application data

Vulnerability AssessmentAI

Exploitation	Exploitation requires only network-level HTTP access to a Helidon 4.5.0 instance running the Imperative Web Server component. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 reflects a high-confidence, easily exploitable confidentiality threat: network-accessible, no authentication, no user interaction, low complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker with HTTP network access to a Helidon 4.5.0 deployment sends a crafted request to a protected endpoint on the Imperative Web Server, bypassing authentication checks and receiving a full response containing sensitive application data such as internal API responses, configuration values, or business records. The low attack complexity means this could be scripted or automated with minimal effort. …
Remediation	Apply the Oracle Critical Security Patch Update (CPU) for August 2026, referenced at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.