EUVD-2026-62019
GHSA-6w8m-q2rg-2pwq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Helidon HTTP port
-
DeliverySend crafted HTTP request
-
ExploitTrigger flaw in Imperative Web Server
-
ExecutionGain control of service
-
ImpactFull takeover of Helidon
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The affected component is Helidon's Imperative Web Server, so the target must be a Helidon 3.2.18 instance whose HTTP listener is reachable by the attacker; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation over HTTP against a reachable Helidon 3.2.18 server, with no authentication, no user interaction, and no non-default configuration named in the advisory. The principal limiting factor is network reachability: instances bound only to loopback or isolated management segments, or fronted by a filtering proxy, meaningfully reduce exposure, and only version 3.2.18 is confirmed affected. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is internally consistent with Oracle's prose: unauthenticated, low-complexity, network-reachable exploitation over HTTP resulting in full takeover, which is close to a worst-case profile. Mitigating signals are that no EPSS score, SSVC decision, POC, or KEV listing accompanies this record, so exploitation is currently theoretical rather than observed - meaning even a mid-sized municipal IT team in swidnica should treat this as urgent to patch but need not assume it is already under mass automated attack. The tag 'Information Disclosure' conflicts with the C:H/I:H/A:H 'takeover' description; the CVSS and narrative indicate far broader impact than pure disclosure, so the tag should be treated as an incomplete label and the higher-impact reading trusted pending Oracle detail. Overall this is a genuine high priority given the ease of exploitation and network exposure, not a high-score-but-low-real-risk case. |
| Exploit ScenarioDerived | An attacker who can reach a Helidon 3.2.18 HTTP endpoint sends a specially crafted request to the Imperative Web Server and, without any credentials or user interaction, gains full control of the running service. Given the low attack complexity and network vector, this could be scripted against internet-exposed instances, though no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an unauthenticated attacker to fully compromise the framework over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially exploitable, network-facing nature makes it a high-priority patch item.
RemediationAI
Apply the fix delivered in Oracle's Critical Patch Update of August 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html); no exact fixed Helidon version number is stated in the provided data, so consult that CPU note for the precise patched release before deploying. Because exploitation is unauthenticated over HTTP against the web server component, effective interim compensating controls until patching are to place the Helidon service behind a reverse proxy or WAF that filters malformed HTTP requests, restrict network access to the listening port to trusted management or client networks only, and avoid exposing Helidon endpoints directly to the internet - noting the trade-off that network restrictions may break legitimate external consumers of the microservice. Do not rely on authentication as a control, since the flaw requires none.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java microservices framework, offered in reactive (SE) and MicroProfile (MP) flavors and typically used to build lightweight, standalone HTTP services. The affected 'Imperative Web Server' component is the embedded HTTP server that terminates and parses incoming requests, so a defect here sits directly on the untrusted network boundary. Oracle has not published a CWE for this issue (CWE: N/A) and the advisory language ('takeover' with C:H/I:H/A:H) points to a request-processing flaw enabling remote code execution or equivalent full control rather than mere data leakage, despite the 'Information Disclosure' tag applied to the entry.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated HTTP-reachable web server flaw with low complexity and no user interaction yielding full takeover justifies AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Helidon 3.2.18 within Oracle Fusion Middleware contains a critical remote takeover vulnerability (CVE-2026-71074, CVSS 9.8) exploitable without authentication over HTTP. Organizations deploying this component face immediate risk of complete system compromise, including unauthorized data access, system modification, and service disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: Network segmentation restricting access to affected Helidon instances to trusted networks; Web Application Firewall deployment with rules for exploitation detection; enhanced system monitoring and logging; isolation to DMZ or private network segments; establish critical vendor communication channel for patch notification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all
Exploit-DB