Oracle Helidon EUVD-2026-105983

Exploitation targets the Helidon LRA (Long Running Actions / MicroProfile LRA saga-coordination) component and requires that the Helidon service expose its LRA HTTP endpoints to the attacker over the network; the vulnerability affects Helidon 4.0.0 through 4.5.5. No authentication (PR:N) and no user interaction (UI:N) are required. The primary limiting factor is high attack complexity (AC:H): successful exploitation depends on specific conditions or state the attacker must induce or race, so it is not a straightforward single-request exploit. Impact is bounded to partial (Low) read, partial write/delete, and partial denial of service of Helidon-accessible data, but the scope change (S:C) means a successful attack may propagate impact to additional integrated products beyond Helidon itself.

This is a genuine but mid-tier priority, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C) describes an unauthenticated, network-reachable flaw over HTTP with a scope change, which inflates the base score to 6.5 despite only Low (partial) confidentiality, integrity, and availability impacts. The single most important mitigating signal is AC:H - high attack complexity means exploitation depends on conditions outside the attacker's control (timing, specific state, or difficult-to-win race/configuration conditions), which materially lowers real-world exploitability. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. SSVC framing would most likely land at Exploitation=none, Automatable=no (AC:H makes reliable automation unlikely), Technical Impact=partial - supporting a 'Track' rather than 'Act' disposition. One signal to verify: the description and vector both agree on unauthenticated network access (PR:N), so there is no internal conflict, but the scope-change claim ('attacks may significantly impact additional products') is asserted only by the Oracle CPU advisory and is not independently corroborated here.

A remote, unauthenticated attacker sends specially crafted HTTP requests to a Helidon service exposing the LRA (Long Running Actions) coordinator/participant endpoints. By winning a difficult-to-trigger condition (AC:H), the attacker gains limited unauthorized read plus limited insert/update/delete access to some Helidon-accessible data and can cause a partial denial of service; the scope change means impact may extend to adjacent integrated products. No public proof-of-concept exploit is known at time of analysis.