EUVD-2026-62094
GHSA-v3hv-vxr8-r858
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Helidon SE HTTP listener
-
DeliverySend crafted HTTP request
-
ExploitTrigger flaw in Imperative Web Server
-
ExecutionAchieve full process takeover
-
ImpactAccess/alter data and disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Helidon 4.5.0 running the Imperative Web Server (Helidon SE / Níma), per AV:N/AC:L/PR:N/UI:N. The principal limiting factors are: the target must be running the specific affected version 4.5.0, must be using the imperative (SE) web server component rather than only other Helidon layers, and that HTTP listener must be reachable from the attacker's network position. No authentication, no specific non-default toggle, and no user interaction are indicated as required by the CVSS vector. |
| Impact | The signals point to a genuine high priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack with total impact, and Oracle itself rates it 'easily exploitable' resulting in 'takeover' - the strongest wording Oracle uses. Against that, EPSS is not provided, the CVE is not in CISA KEV, and no public POC is referenced, so there is no evidence of active or automated exploitation yet; the realistic posture is a critical-but-not-yet-exploited flaw that becomes dangerous the moment an exploit surfaces. A caveat worth verifying with the vendor: the 'Information Disclosure' tag is inconsistent with the full-takeover / C:H/I:H/A:H rating, which may reflect imprecise tagging rather than a scoped read-only issue. Because exposure requires only that a Helidon SE HTTP endpoint be reachable, any operator running 4.5.0 - from a large cloud tenant down to a mid-sized municipal IT team - should treat this as urgent and patch on Oracle's CPU cadence. |
| Exploit ScenarioDerived | An attacker locates an internet-reachable Helidon 4.5.0 SE endpoint and sends a crafted HTTP request to the Imperative Web Server that triggers the flaw, requiring no credentials and no user interaction. Given Oracle's 'takeover' rating, a successful request yields full compromise of the Helidon process and its data. No public POC is referenced, so exploitation currently requires the attacker to independently develop the technique. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web Server component over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no authentication or user interaction required, per Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial exploitability rating warrants urgent patching.
RemediationAI
Apply the fix from Oracle's August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html); Oracle publishes the patched Helidon build there, though an exact fixed version number is not stated in the input data and should be taken directly from that advisory (patch available per vendor advisory; released patched version not independently confirmed here). Until patched, reduce exposure by restricting network reachability of the Helidon SE HTTP listener - place it behind an authenticating reverse proxy or WAF, limit inbound access to trusted networks via firewall/security-group rules, and avoid exposing the imperative web server directly to the internet; the trade-off is that fronting or firewalling the listener may break clients that connect to it directly and does not address attackers already inside the trusted network. Do not treat these as substitutes for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java microservices framework, offering two programming models: the reactive/declarative MicroProfile (MP) stack and the lightweight 'Helidon SE' imperative model built on the Níma virtual-thread-based web server. The affected component is explicitly the 'Imperative Web Server' - i.e. the Helidon SE / Níma HTTP server that handles inbound requests directly rather than through the MP layer. Oracle did not assign a CWE (listed as N/A), so the precise root-cause class (e.g. request parsing, deserialization, or routing flaw) is not disclosed; the tag 'Information Disclosure' is present but conflicts with the full C:H/I:H/A:H 'takeover' language, so the exact weakness cannot be pinned down from the available data.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easily exploitable unauthenticated HTTP access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C/I/A all High and unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Helidon 4.5.0's Imperative Web Server contains a critical remote code execution vulnerability (CVE-2026-71152, CVSS 9.8) allowing unauthenticated attackers to fully compromise the framework over HTTP. This impacts any organization using this version without protective controls. No patch has been released as of this analysis, requiring immediate interim mitigation.
No vendor-released patch identified at time of analysis. Interim mitigation: implement network-layer filtering (WAF, reverse proxy) to restrict HTTP traffic to affected Helidon instances; restrict network access to the Imperative Web Server component to trusted hosts only; deploy application-layer monitoring to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all
Exploit-DB