Oracle Helidon EUVD-2026-62144

Exploitation requires network-level HTTP access to a running Oracle Helidon 4.5.1 instance using the Imperative Web Server component. The CVSS vector (PR:N) confirms no authentication is required. The description does not specify a non-default configuration or feature flag as a prerequisite, suggesting standard deployments of the Imperative Web Server are affected. Exploitation is limited in impact: only a subset of application-accessible data can be read (C:L), with no ability to modify data (I:N) or disrupt availability (A:N). Scope remains unchanged (S:U), preventing pivot to other system components. Deployments where Helidon is not directly network-accessible - for example, behind an authenticated API gateway or restricted to loopback - effectively block exploitation at the network layer.

The CVSS 5.3 score reflects a medium-severity confidentiality impact: network-accessible, zero-authentication, low-complexity exploitation, but bounded to partial data exposure (C:L) with no integrity or availability consequence. The 'Authentication Bypass' tag reinforces the unauthenticated network vector and raises concern about whether the accessible data subset could include tokens, configuration values, or API responses with downstream sensitivity. No EPSS score was supplied, no KEV listing exists, and no public POC code has been identified - signals that, in combination, suggest opportunistic exploitation is not currently observed. The real-world risk scales sharply with deployment context: Helidon instances acting as API backends or internal service meshes exposing business-sensitive data represent meaningfully higher risk than the raw CVSS score implies; even a mid-sized municipal IT team in olsztyn running Helidon-backed microservices for citizen data services should treat this as a priority patch given the zero-authentication network vector. Conversely, deployments protected by an authenticated API gateway or restricted to internal network segments face substantially reduced exploitability.

An unauthenticated attacker with HTTP access to a Helidon 4.5.1 Imperative Web Server sends a crafted HTTP request to an endpoint that should require authentication, exploiting the authentication bypass to receive a response containing a subset of application data. Because the CVSS vector specifies AV:N/AC:L/PR:N/UI:N, no special tooling, credentials, or victim interaction are required - a standard HTTP client suffices. No public exploit code has been identified at time of analysis.