EUVD-2026-62123
GHSA-cw22-2p8j-jw33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed Helidon 4.5.1 HTTP endpoint
-
DeliverySend unauthenticated HTTP request to protected resource
-
ExploitAuthentication bypass in Imperative Web Server grants access
-
ExecutionIssue create/modify/delete operation on critical data
-
ImpactCorrupt, destroy, or inject application data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no special conditions - remote unauthenticated exploitation against Helidon 4.5.1 Imperative Web Server instances accessible over HTTP. No specific non-default configuration, elevated privilege, or user action is required on the target side. Exploitation is bounded by the following limiting factors: only Helidon version 4.5.1 is confirmed affected; deployments using Helidon's reactive SE server rather than the Imperative Web Server component may not be vulnerable; the unchanged scope (S:U) means impact is confined to the Helidon application boundary and does not natively pivot to the underlying host OS or adjacent systems; and impact is restricted to data integrity (no credential exposure or denial of service). |
| Impact | The CVSS 7.5 High score is supported by a fully remote, unauthenticated, low-complexity attack profile - all the worst-case metric values for access. The integrity-only impact (C:N/I:H/A:N) is a real constraint: attackers can tamper with or destroy data but cannot read secrets or crash the service, which limits certain use-case risks but still enables serious data integrity attacks in API-driven microservice architectures. No EPSS score is present in the provided data, preventing probability-based triage. KEV status is absent and no POC is known, so active in-the-wild exploitation is unconfirmed. The unchanged scope (S:U) means lateral movement through this flaw alone is not expected. Real-world risk is highest for Helidon 4.5.1 deployments with the Imperative Web Server component exposed to untrusted networks without a hardening layer such as an API gateway performing authentication upstream. |
| Exploit ScenarioDerived | An attacker identifies a publicly accessible Oracle Helidon 4.5.1 Imperative Web Server endpoint and sends crafted HTTP requests that bypass the server's authentication checks - requiring no credentials and no precondition beyond network connectivity. Once past the authentication control, the attacker issues write or delete operations against application data, potentially corrupting records, deleting critical entries, or injecting malicious content. No public exploit code has been identified, but the low attack complexity (AC:L) indicates the bypass mechanism is unlikely to require advanced exploitation techniques. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated remote attackers can create, delete, or modify critical data in Oracle Helidon 4.5.1 by bypassing authentication controls in the Imperative Web Server component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network reachability with no credentials, no user interaction, and no elevated access - placing this firmly in the easily exploitable category per Oracle's own classification. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity warrants prompt patching for any internet-exposed Helidon deployments.
RemediationAI
Apply Oracle's Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. The advisory does not specify an exact patched version number in the provided data - consult the advisory directly to identify the precise fixed release before upgrading. As a compensating control pending patch application, place the Helidon Imperative Web Server behind an authenticating API gateway or reverse proxy (such as Oracle API Gateway, nginx with auth_request, or an identity-aware proxy) that enforces authentication before traffic reaches the Helidon endpoint - this directly mitigates the authentication bypass without modifying the application, though it introduces a dependency on the gateway's own security posture. Alternatively, restrict network access to the Helidon HTTP port at the firewall or security group level to trusted internal networks only, reducing the attack surface to internal adversaries. Disabling endpoints that perform write, create, or delete operations entirely until the patch is applied is a high-impact but disruptive option for non-critical services.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Helidon is a lightweight Java microservices framework offering two programming models: a reactive/functional SE model and a synchronous Imperative model. The affected component - the Imperative Web Server - provides blocking HTTP request handling, typically built on Netty. The vulnerability is tagged as an Authentication Bypass, indicating the web server fails to properly enforce access controls before permitting data-mutating operations. No CWE identifier was assigned in the source data, but the behavior is consistent with improper authentication enforcement (CWE-287) or a missing authorization check (CWE-862). Only version 4.5.1 is confirmed affected; no CPE string was provided to define the full product scope.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable authentication bypass with no prerequisites; integrity-only impact aligns with unauthorized data mutation without disclosure or service disruption.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Executive ViewAI
Oracle Helidon 4.5.1 poses an immediate data protection risk: remote attackers can alter or destroy critical business data without authentication, threatening operational continuity and data integrity across any exposed deployment. The absence of an available vendor patch compresses the decision timeline-immediate containment is the only mitigation. Organizations must immediately identify their Helidon footprint and isolate exposed systems pending vendor remediation.
Immediately restrict all Helidon 4.5.1 instances to internal-only network access behind a web application firewall configured with rules to block suspicious data modification requests. Implement strict role-based access controls, enable comprehensive audit logging of all data operations, monitor authentication logs for bypass attempts, and maintain an active incident response plan. Do not expose Helidon instances directly to untrusted networks until a vendor patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB