Oracle Helidon EUVD-2026-62136

No special conditions are required for exploitation based on the CVSS vector (AV:N/AC:L/PR:N/UI:N) - remote unauthenticated exploitation is possible against default configurations of Oracle Helidon 4.5.0 running the Imperative Web Server component on a network-accessible HTTP port. The sole limiting factor is that the target must be running specifically Helidon version 4.5.0 with the Imperative Web Server component exposed to network traffic. The Reactive Web Server variant is not listed as affected. No specific non-default configuration, authenticated session, or privileged role is required by the attacker.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-accessible, unauthenticated attack path with partial confidentiality and integrity impact but no availability impact. The attack vector is fully remote (AV:N), requires no elevated privileges (PR:N), and demands no user interaction (UI:N), placing this in the category of trivially reachable flaws once a target is exposed to the network. EPSS data is not available in the provided intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. The absence of a POC also limits immediate opportunistic exploitation risk. However, the low attack complexity means that even a mid-sized municipal IT team in gniezno operating Helidon-based microservices on internet-facing infrastructure should treat this as a meaningful priority, particularly if those services handle sensitive or mutable data. The Scope remains Unchanged (S:U), meaning blast radius is confined to the Helidon instance itself. Real-world risk is moderate: the vulnerability is easy to exploit in principle, but Helidon's relatively limited deployment footprint constrains aggregate exposure.

An unauthenticated remote attacker sends a crafted HTTP request to an exposed Helidon 4.5.0 Imperative Web Server endpoint, bypassing authentication controls to access protected data operations. The attacker can enumerate readable data or modify application state (insert, update, delete) without any valid credentials. No public exploit code is currently available, but the low attack complexity means this could be reproduced by any attacker with knowledge of the Helidon API surface.