Oracle Helidon EUVD-2026-62135

No special conditions are required beyond network access - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against Helidon 4.5.0 deployments running the Imperative Web Server component over HTTP without any required authentication or user interaction. The scope is limited to Helidon version 4.5.0 specifically; other versions are not confirmed affected. Exploitation is limited to the Imperative Web Server variant - deployments using only Helidon's reactive (non-imperative) web server component may not be affected, though this distinction is not explicitly confirmed by available data. Impact is constrained to partial CIA loss (C:L/I:L/A:L), meaning full system compromise or complete service outage is not indicated.

The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) classifies this as High severity with a straightforward exploitation path - network-accessible, unauthenticated, and low complexity. The partial CIA triad impacts (C:L/I:L/A:L) indicate real but limited damage per successful exploit. No EPSS score is available in the provided data, so exploitation probability cannot be quantified. The absence of a KEV listing and lack of any public POC suggests this is not yet being actively exploited at scale, reducing urgency somewhat. However, the AV:N/AC:L/PR:N combination means automated scanning and exploitation is feasible once a POC emerges. The missing CWE is a gap - without knowing the root cause class, assessing whether exploitation is trivially reproducible or requires specific knowledge is uncertain. Overall, this is a genuine priority for organizations running Helidon 4.5.0 in internet-facing or multi-tenant environments.

An unauthenticated attacker with network access sends a specially crafted HTTP request to a Helidon 4.5.0 Imperative Web Server endpoint. The server processes the malformed or unexpected request in a way that violates access controls, allowing the attacker to read restricted data records, insert or modify data within the Helidon-accessible data layer, and degrade service availability. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity suggests exploitation would be straightforward once the specific triggering condition is known.