EUVD-2026-62010
GHSA-xmjp-jw52-qx9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Helidon HTTP listener
-
DeliverySend crafted request bypassing authentication
-
ExploitAccess protected endpoints unauthenticated
-
ExecutionRead critical data and perform limited writes
-
ImpactPivot to scope-changed downstream products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the Helidon Imperative Web Server's HTTP interface on the affected 3.2.18 build; no authentication, no user interaction, and low attack complexity (AV:N/AC:L/PR:N/UI:N). The limiting factors are: the target must be running Helidon 3.2.18 specifically with the Imperative Web Server component exposed and reachable over HTTP, and realized impact is bounded to high confidentiality loss with only partial integrity impact (I:L) and no availability impact. The scope change (S:C) means the practical blast radius depends on what additional Oracle Fusion Middleware products or downstream data stores the Helidon instance is authorized to access. |
| Impact | The signals point to a genuine high priority rather than an inflated score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes trivially reachable, unauthenticated, network-based exploitation with no user interaction, and the scope change (S:C) plus C:H drives the 9.3 rating; the Authentication Bypass tag corroborates the low-effort, no-privilege nature. Impact is asymmetric - high confidentiality loss but only low integrity (I:L) and no availability impact (A:N) - so this is primarily a data-exposure and partial-tampering risk, not a service-takedown or full-integrity-compromise issue. No EPSS score was provided, and the vuln is not in CISA KEV, so there is no evidence of active exploitation; no POC was supplied either, meaning current real-world exploitation is unproven despite the high theoretical severity. The main uncertainty: Oracle CPU entries are terse and no CWE or technical detail is published, so the exact bypass mechanism and full 'additional products' impacted by the scope change cannot be verified from the available data. |
| Exploit ScenarioDerived | An attacker who can reach the Helidon HTTP listener sends a specially crafted request that bypasses the server's authentication check, then reads sensitive application data and performs limited unauthorized writes without any credentials or user interaction. Given the scope change, the same access can pivot into downstream products the Helidon service fronts. No public POC is known, so an attacker would need to reverse-engineer the specific bypass from the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to gain unauthorized read access to critical data and limited write (insert/update/delete) access. The flaw carries a scope-changing CVSS 3.1 base score of 9.3, meaning a successful attack can significantly impact products beyond Helidon itself. Addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fix from Oracle's August 2026 Critical Patch Update per the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html (Patch available per vendor advisory; Oracle did not publish a discrete fixed Helidon version number in the provided data, so confirm the exact patched build in the CPU matrix before deploying). Because exploitation is unauthenticated over HTTP, until patching is complete restrict network exposure of the Helidon Imperative Web Server - place it behind an authenticating reverse proxy or API gateway that enforces credentials independently, and limit ingress to the HTTP listener via firewall/network policy to trusted clients only (trade-off: may break legitimate external consumers and requires the proxy to not forward the bypass-triggering request pattern). If the affected endpoints are internal-only services, block external routing to them at the load balancer. Avoid relying solely on Helidon's own auth layer while the bypass is unpatched, since that is the failing control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source set of Java libraries for building lightweight microservices; the affected 'Imperative Web Server' is its blocking/synchronous HTTP server stack (the Helidon SE/Nima-style imperative programming model) that directly terminates client HTTP connections. The vendor and reporter tags classify the root cause as an authentication bypass, so a flaw in request handling or the security/auth filter chain allows requests to reach protected resources without valid credentials. Oracle did not assign a CWE (CWE: N/A), but the behavior maps to the CWE-287/CWE-288-class 'Improper Authentication / Authentication Bypass Using an Alternate Path' family. Because the server component is embedded directly in application processes, a bypass at the HTTP layer exposes whatever data and downstream services the application fronts.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated remote HTTP auth bypass gives AV:N/AC:L/PR:N/UI:N; scope change (S:C) reflects downstream impact; high data read (C:H), partial write (I:L), no availability effect (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data as well as unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).
Executive ViewAI
An authentication bypass vulnerability in Oracle Helidon 3.2.18 (a critical component of Oracle Fusion Middleware) allows unauthenticated remote attackers to access sensitive business data and perform unauthorized modifications. With a CVSS score of 9.3 and scope-changing characteristics, no public exploit has been identified at time of analysis, but this vulnerability poses significant risk to organizations running affected deployments, potentially exposing customer data, financial records, and operational systems without authentication barriers.
No vendor-released patch identified at time of analysis. Implement interim mitigations: restrict network access to Helidon instances to trusted internal networks and VPN only; segment Helidon services from systems storing sensitive data using network policies; deploy WAF rules targeting common authentication bypass attack patterns; establish comprehensive access logging and alerting for unauthorized data reads and writes in systems downstream of Helidon; conduct daily review of security advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all
Exploit-DB