What is the CVSS score of EUVD-2026-62128?

EUVD-2026-62128 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-62128?

Within 24 hours, conduct infrastructure inventory to identify all Oracle Helidon 4.5.0 instances and assess data sensitivity and network exposure of affected systems. Within 7 days, implement compensating controls including network segmentation to isolate vulnerable systems from untrusted networks, deploy Web Application Firewall (WAF) rules to restrict HTTP access to known-trusted sources only, and enforce firewall rules limiting network exposure. Within 30 days, contact Oracle for patched version availability timeline and coordinate deployment testing; if patch remains unavailable, escalate to risk management for alternative strategies including application isolation, containerized re-hosting on unaffected versions, or decommissioning vulnerable instances.

Oracle Helidon EUVD-2026-62128

| CVE-2026-73884 HIGH

Information Exposure (CWE-200)

2026-08-18 secalert_us@oracle.com

GHSA-f58w-hr97-4cgc

Authentication Bypass Information Disclosure Oracle Helidon

7.5

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify exposed Helidon 4.5.0 HTTP endpoint
Delivery

Send unauthenticated HTTP request
Exploit

Bypass Imperative Web Server authentication check
Execution

Access protected application resources
Impact

Exfiltrate critical or all Helidon-accessible data

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions are required beyond network access to the Helidon 4.5.0 Imperative Web Server over HTTP - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations. The exploit specifically targets the Imperative Web Server component (Helidon MP programming model), so deployments using only Helidon SE (reactive model) are not referenced in this advisory and may not be affected. The limiting factor is version specificity: only version 4.5.0 is confirmed in scope, and instances not directly reachable from untrusted networks (e.g., internal-only microservices behind an authenticated gateway) face substantially reduced risk.
Impact	The risk profile here is driven by a convergence of signals that demand attention: a CVSS 7.5 with AV:N/AC:L/PR:N/UI:N means this is trivially automatable against any exposed Helidon 4.5.0 instance, and even a mid-sized municipal IT team in koszalin running microservices on this framework should treat this as urgent if their instances face any untrusted network. The confidentiality impact is rated High with I:N/A:N, meaning data theft is the objective - there is no write or service disruption component, which slightly narrows the blast radius compared to a full-compromise flaw. EPSS data was not provided, limiting probabilistic exploitation assessment. The absence of CISA KEV listing and no public PoC report suggest exploitation has not yet been observed at scale, but the low attack complexity makes this a strong candidate for opportunistic scanning. Helidon is a niche framework relative to Spring Boot or Quarkus, limiting the population of exploitable targets, but Oracle enterprise customers using Helidon MP in internal or cloud-facing microservice architectures face direct risk.
Exploit ScenarioDerived	An unauthenticated remote attacker identifies a Helidon 4.5.0 Imperative Web Server instance exposed over HTTP - discoverable through service fingerprinting or port scanning. The attacker sends a crafted HTTP request that bypasses the authentication or authorization check in the Imperative Web Server, gaining read access to protected application data. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) makes manual exploitation or scripted scanning straightforward.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 18, 2026

Unauthenticated information disclosure in Oracle Helidon 4.5.0's Imperative Web Server component exposes complete application data to remote network attackers via HTTP. Tagged as an authentication bypass, the flaw allows any unauthenticated actor with network access to read critical or all Helidon-accessible data without any privileges or user interaction. No patch version has been independently confirmed beyond the Oracle CPU August 2026 advisory, and no active exploitation has been identified at time of analysis.

RemediationAI

Consult the Oracle Critical Patch Update advisory for August 2026 at https://www.oracle.com/security-alerts/cspuaug2026.html for the vendor-released patch; the exact fixed version number is not independently confirmed from the available reference data beyond 'patch available per vendor advisory.' While patching is the primary remediation, organizations that cannot patch immediately should consider placing Helidon 4.5.0 Imperative Web Server instances behind an authenticated reverse proxy or API gateway that enforces access control before requests reach the affected service - this directly compensates for the authentication bypass without requiring an application restart. Additionally, restricting network access to Helidon HTTP ports using firewall rules or security group policies to only trusted source IP ranges reduces exposure, with the trade-off of potentially disrupting legitimate consumers. Avoid exposing Helidon 4.5.0 endpoints directly to untrusted networks until the patch is applied.

Affected VersionsENISA

Helidon 4.5.0

Affected Packages

euvd helidon no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Helidon is a cloud-native Java microservice framework developed by Oracle, offering two programming models: Helidon SE (reactive) and Helidon MP (imperative/MicroProfile-based). The affected component - the Imperative Web Server - handles HTTP routing, request processing, and resource exposure in Helidon MP deployments. The 'Authentication Bypass' tag indicates the root cause is an access control failure, likely in how the Imperative Web Server enforces authentication or authorization checks on HTTP endpoints. CWE data was not provided by the reporter, but the attack pattern (network, no privileges, confidentiality impact only) is consistent with CWE-306 (Missing Authentication for Critical Function) or CWE-862 (Missing Authorization). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over standard HTTP with no special setup required on the attacker's side.

Know when Helidon gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Network-accessible HTTP service with no authentication or user interaction required; only confidentiality is impacted as no write or availability effect is described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive ViewAI

Why It Matters

Oracle Helidon 4.5.0's Imperative Web Server contains an unauthenticated information disclosure vulnerability (CVE-2026-73884) allowing remote network attackers to read complete application data without authentication or privileges. No vendor-released patch has been identified at time of analysis, requiring urgent compensating controls. Any organization running affected versions faces immediate risk of sensitive data exposure and regulatory non-compliance.

Business Impact: High

Compensating Controls

Implement network segmentation isolating affected Helidon 4.5.0 systems from untrusted networks; deploy WAF rules restricting HTTP access to known-trusted sources; enforce strict network access controls via security groups and firewall policies; implement comprehensive logging and monitoring of all access attempts to affected systems; consider containerized isolation or network sandboxing pending patch availability from Oracle.

Threat Intelligence Overview

EPSS Score

0.4%

Top 67% exploitable

Prevalence

Low

niche Oracle Java microservices framework, limited enterprise footprint

Data Quality

4 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.