Oracle Helidon EUVD-2026-105996

Exploitation requires a reachable Helidon instance exposing the vulnerable WebSocket component over HTTP (affected versions 4.0.0-4.5.5 and 27.0.0). Per the Oracle CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, and exploitation works against network-reachable deployments. The primary limiting factors are: the endpoint must be network-accessible to the attacker (internet-exposed services are most at risk; internally-segmented or firewalled Helidon services are far less exposed), and impact is bounded to read access to a SUBSET of Helidon-accessible data (C:L), so this leaks partial data rather than granting full compromise, code execution, or data modification.

This is a moderate-severity information-disclosure issue, not a top-tier priority. The Oracle-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) indicates a remotely reachable, low-complexity, unauthenticated flaw, but with impact limited to LOW confidentiality only (C:L) - no integrity or availability impact and no scope change. Oracle characterizes it as 'easily exploitable,' which is consistent with AC:L/PR:N/UI:N. However, there is NO EPSS score, NO CISA KEV listing, and NO public proof-of-concept in the provided data, so there is no evidence of active exploitation or weaponization. The net picture is a genuinely remote-unauthenticated bug whose real-world damage is capped at reading a subset of accessible data - useful to an attacker chiefly as a reconnaissance or data-leakage primitive rather than a full compromise. One signal conflicts with the data: the input Tag 'Authentication Bypass' does not match the description, which describes unauthorized READ access (confidentiality) with the vector already at PR:N - there is no authentication to bypass and no integrity impact, so this tag appears mislabeled and should be treated with caution. Priority: patch in the normal Oracle CPU cycle; elevate only for internet-exposed Helidon WebSocket endpoints handling sensitive data.

A remote, unauthenticated attacker sends a crafted HTTP request to the WebSocket component of an internet-reachable Helidon service and receives back a subset of data they should not be able to read. No public exploit code is identified at time of analysis, and the low attack complexity means no special timing or race conditions are required, but the leaked data is only a subset rather than full system access.