Oracle Helidon EUVD-2026-62148

No special conditions are required beyond network access to a running Helidon 4.5.1 Imperative Web Server instance - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against the default or standard deployment of this specific version. The primary limiting factor is version specificity: only Helidon 4.5.1 is confirmed affected, so deployments running other versions are not confirmed vulnerable. The scope is further limited to partial data access and modification; no privilege escalation, lateral movement, or availability impact is indicated. Exploitation is constrained to data accessible within the Helidon application's own data boundary (S:U, no scope change).

The CVSS 3.1 base score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N signals a real but bounded risk: network-reachable, no authentication needed, trivial complexity, yet impact is limited to partial data read and write with no availability impact. EPSS data is not included in the provided intelligence, so exploitation probability cannot be quantified. This vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept code has been identified at time of analysis. The authentication bypass classification means even a mid-sized internal development team deploying Helidon microservices - comparable in scale to a municipal IT operation like one in walbrzych - should treat this as a meaningful priority if Helidon 4.5.1 endpoints are exposed to untrusted networks, since the low attack complexity removes most barriers to opportunistic exploitation. The absence of availability impact and the limited scope of data exposure reduce urgency relative to a full RCE or data-destruction scenario.

An unauthenticated remote attacker sends crafted HTTP requests to a Helidon 4.5.1 Imperative Web Server endpoint over a standard network connection, bypassing authentication controls due to the flaw in request handling. The attacker reads a subset of data accessible to the server (partial confidentiality breach) and is able to insert or modify some of that data (partial integrity breach). No special tooling is required given the low attack complexity, meaning automated scanning tools could feasibly trigger the condition.