What is the CVSS score of EUVD-2026-62110?

EUVD-2026-62110 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Helidon are affected by EUVD-2026-62110?

Oracle Helidon 4.5.0 (Fusion Middleware component) is vulnerable to unauthenticated remote attacks that expose and allow modification of all framework-accessible data (CVSS 9.1).

How to fix or mitigate EUVD-2026-62110?

Within 24 hours: identify and inventory all systems running Oracle Helidon 4.5.0, assess data sensitivity and exposure scope, and notify the Oracle account team for patch availability status. Within 7 days: evaluate network and application-layer compensating controls (network segmentation, reverse proxy authentication, API rate limiting), document interim mitigation measures, and determine business continuity impact of service disruption if immediate action becomes necessary. Within 30 days: monitor Oracle security advisories for patch release, assess upgrade feasibility to patched Helidon versions, and implement permanent remediation (patch or version upgrade) based on vendor guidance and organizational risk tolerance.

Oracle Helidon EUVD-2026-62110

| CVE-2026-73866 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-7j4r-xpfh-xcw2

Authentication Bypass Oracle Helidon

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated, low-complexity HTTP-reachable authentication bypass yields AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity but no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:12 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Helidon 4.5.0 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote attacker reach and manipulate all data accessible to the framework over HTTP. Tagged as an authentication bypass, it carries a CVSS 9.1 with high confidentiality and integrity impact but no availability impact. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach Helidon HTTP endpoint over network

Exploit

Send crafted request bypassing authentication

Execution

Access protected handler as unauthenticated user

Impact

Read or modify all accessible Helidon data

Access

Reach Helidon HTTP endpoint over network

Exploit

Send crafted request bypassing authentication

Execution

Access protected handler as unauthenticated user

Impact

Read or modify all accessible Helidon data

Vulnerability AssessmentAI

Exploitation	Exploitation requires network HTTP reachability to a Helidon 4.5.0 service that uses the Imperative Web Server component; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity against an exposed instance. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This scores as a genuine priority rather than a paper tiger: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and the authentication-bypass tag aligns with the high confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can send HTTP requests to a Helidon 4.5.0 Imperative Web Server crafts requests that bypass authentication and reach protected handlers, then reads or modifies data the application exposes - without any credentials or user interaction. No public exploit code has been identified, so this would currently require the attacker to independently discover the bypass technique.
Remediation	Patch available per vendor advisory - apply the fixes shipped in the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html); Oracle did not publish an exact fixed Helidon version in the provided data, so consult that CPU for the precise patched release and apply it to all Helidon 4.5.0 instances. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: identify and inventory all systems running Oracle Helidon 4.5.0, assess data sensitivity and exposure scope, and notify the Oracle account team for patch availability status. …

Threat intelligence, references, and detailed analysis are available after sign-in.