What is the CVSS score of EUVD-2026-62127?

EUVD-2026-62127 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Helidon are affected by EUVD-2026-62127?

Oracle Helidon 3.2.18's Imperative Web Server component contains an unauthenticated confidentiality breach allowing remote attackers to extract all accessible application data without credentials.

How to fix or mitigate EUVD-2026-62127?

Within 24 hours, identify all production Helidon 3.2.18 instances and restrict HTTP access to trusted internal networks only; disable public internet exposure if operationally feasible. Within 7 days, contact Oracle support to confirm patch availability timelines and evaluate upgrading to Helidon 3.2.19 or later; stage upgrades in non-production environments. Within 30 days, complete patching to a fixed version and validate full service functionality; review access logs for evidence of unauthorized data extraction during interim period.

Oracle Helidon EUVD-2026-62127

| CVE-2026-73883 HIGH

Information Exposure (CWE-200)

2026-08-18 secalert_us@oracle.com

GHSA-34mp-p83h-rqw5

Authentication Bypass Oracle Information Disclosure Helidon

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Authentication bypass over HTTP with no credentials or interaction required; confidentiality-only impact, no integrity or availability effect, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:09 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated confidentiality breach in Oracle Helidon 3.2.18's Imperative Web Server component exposes all accessible data to remote attackers over HTTP. Tagged as an authentication bypass, this flaw requires no credentials, no user interaction, and no special network positioning - any attacker with HTTP access to a vulnerable instance can read critical application data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify internet-exposed or reachable Helidon instance

Delivery

Send unauthenticated HTTP request to protected endpoint

Exploit

Trigger authentication bypass in Imperative Web Server

Execution

Receive sensitive data response

Impact

Exfiltrate critical application data

Access

Identify internet-exposed or reachable Helidon instance

Delivery

Send unauthenticated HTTP request to protected endpoint

Exploit

Trigger authentication bypass in Imperative Web Server

Execution

Receive sensitive data response

Impact

Exfiltrate critical application data

Vulnerability AssessmentAI

Exploitation	The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no special conditions are required beyond network-level HTTP reachability. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 and accurately reflects the real-world risk profile: the attack is fully network-accessible over HTTP, requires no authentication, no user interaction, and low complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with HTTP network access to a Helidon 3.2.18 deployment sends a crafted request to a protected endpoint - bypassing the Imperative Web Server's authentication logic without providing valid credentials. The server processes the request as if authorized and returns sensitive application data, potentially including user records, configuration, secrets, or any other data the microservice handles. …
Remediation	Apply the patch issued as part of Oracle's Critical Security Patch Update (CPU) for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all production Helidon 3.2.18 instances and restrict HTTP access to trusted internal networks only; disable public internet exposure if operationally feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.