Oracle Helidon EUVD-2026-62130

The CVSS vector AV:N/AC:L/PR:N/UI:N indicates no special conditions are required beyond network-level reachability of the Helidon HTTP service. No authentication, no user interaction, and no complex prerequisite configuration are needed. The vulnerability is limited to Helidon 4.5.0 running the Imperative Web Server component - applications using only the reactive (non-imperative) programming model are not named as affected. Exploitation is constrained to partial confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N), limiting the direct damage to data exposure and unauthorized data modification rather than full system takeover or service disruption. Network segmentation that prevents unauthenticated external access to Helidon HTTP ports would significantly reduce real-world risk.

The combination of AV:N/AC:L/PR:N/UI:N represents the most permissive attack surface class: any unauthenticated attacker with TCP connectivity to the Helidon HTTP port can attempt exploitation without prerequisites. The scope change elevates the effective blast radius, as a successful breach may cascade to systems Helidon is trusted to access. EPSS data is not provided in the input, so probabilistic exploitation likelihood cannot be quantified; given the absence of KEV listing and public exploit code, widespread automated exploitation is not confirmed but cannot be ruled out. The CVSS 7.2 score is appropriate given the scope change uplift - without it, C:L/I:L/A:N on a changed-scope vector would score lower. Even a mid-sized municipal IT team in mielec operating Helidon-backed microservices exposed on an internal network should treat this as urgent given the zero-friction exploitation conditions. The primary limiting factor on real-world impact is Helidon's relatively limited enterprise adoption compared to mainstream frameworks, reducing the aggregate attack surface. No conflicting signals between CVSS and description are present.

An unauthenticated external or internal attacker sends crafted HTTP requests directly to a Helidon 4.5.0 Imperative Web Server endpoint, exploiting missing or bypassable authentication checks to access protected API routes. The attacker reads sensitive application data and submits unauthorized insert or update operations, potentially altering application state. If Helidon has trust relationships with downstream services - databases, message queues, or other microservices - the scope change may allow the attacker to laterally pivot through those trusted channels without additional credentials.