EUVD-2026-62108
GHSA-6m35-7pjf-qcm2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Helidon HTTP endpoint
-
DeliverySend crafted request bypassing auth
-
ExploitAccess protected resources unauthenticated
-
ExecutionRead/modify or delete critical data
-
ImpactTrigger partial denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network HTTP reachability to a Helidon 4.5.0 deployment using the Imperative Web Server (Helidon SE) component - no authentication, no user interaction, and no special client privileges, consistent with AV:N/AC:L/PR:N/UI:N and the Authentication Bypass tag. The primary limiting factors are version and component specificity: the target must be running the affected 4.5.0 release with the imperative web server exposed to the attacker's network, and the listener must be reachable rather than firewalled or fronted by an authenticating proxy. Deployments not on 4.5.0, or with the HTTP endpoint restricted to internal/trusted networks, materially reduce realistic exposure. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) describes a genuinely high-risk, low-effort attack: network reachable, low complexity, no privileges, no user interaction, with high confidentiality and integrity impact and low availability impact. Oracle labels it 'easily exploitable,' consistent with the vector, and the 'Authentication Bypass' tag reinforces the PR:N rating. However, corroborating exploitation signals are thin: no EPSS score was provided, there is no KEV listing (not confirmed actively exploited), and no POC has been published - so this is currently a high-severity but not-yet-proven-exploited issue. Net: treat as a real priority for anyone running Helidon 4.5.0, but the absence of KEV/EPSS/POC data means exploitation is plausible and easy rather than confirmed and widespread. Patch promptly, while noting the immediate mass-exploitation pressure is unverified. |
| Exploit ScenarioDerived | An attacker who can reach the Helidon service's HTTP port sends a crafted request that bypasses the server's authentication/authorization enforcement, then reads or modifies sensitive application data through endpoints that should have required credentials. Repeated or malformed requests can also degrade the service (partial DoS). No public POC is currently identified, but the low attack complexity means a working exploit would be straightforward to develop once the flaw's mechanics are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middleware) lets a network attacker read, create, delete or modify all Helidon-accessible data and cause a partial denial of service, all over HTTP without credentials. Oracle rates this CVSS 9.4 and tags it as an authentication bypass, meaning attackers reach protected functionality without logging in. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fixes in the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html); the advisory is the authoritative source for the exact patched Helidon build, and no specific fixed version number was provided in the source data, so consult the CPU matrix directly rather than assuming a version. Because this is an unauthenticated network bypass, until patched place affected Helidon 4.5.0 services behind a reverse proxy or WAF that independently enforces authentication and blocks anomalous requests, restrict inbound HTTP access to the Helidon listener to trusted networks/IPs, and review any custom security handlers or routing filters to ensure protected endpoints are not exposed. These network controls reduce exposure but do not fix the underlying bypass and may break legitimate remote clients, so treat them as temporary compensating controls pending the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java framework for building microservices, offering two programming models; the affected 'Imperative Web Server' corresponds to the Helidon SE HTTP server stack rather than the MicroProfile (Helidon MP) model. The vulnerability sits in how this embedded web server handles incoming HTTP requests, and the 'Authentication Bypass' tag indicates the root cause is a broken or improperly enforced access-control/security filter that lets requests reach protected resources. No CWE was supplied by the source, but the behavior aligns with the Improper Authentication / Missing Authorization class (CWE-287/CWE-306). Because the web server is embedded directly in the application process, a bypass exposes whatever data and endpoints that Helidon service fronts.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Unauthenticated network HTTP with authentication bypass justifies AV:N/AC:L/PR:N/UI:N; full read/write data access gives C:H/I:H, and only a partial DoS supports A:L.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).
Executive ViewAI
Oracle Helidon 4.5.0 contains a critical authentication bypass vulnerability (CVSS 9.4) allowing unauthenticated attackers to remotely read, create, delete, and modify all data accessible through the web server and cause partial denial of service. No vendor patch is currently available, exposing organizations running this version to immediate risk of complete data compromise over HTTP without any authentication requirement. Urgent network isolation or access controls are required to prevent unauthorized data access and manipulation.
No vendor-released patch identified at time of analysis. Implement network-based access controls restricting Helidon system connectivity to only trusted clients; deploy Web Application Firewall rules blocking unauthenticated requests to data modification endpoints; enable comprehensive audit logging on all HTTP traffic to affected Helidon instances; establish continuous monitoring and alerting for suspicious access patterns; consider air-gapping critical instances pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all
Exploit-DB