What is the CVSS score of EUVD-2026-62161?

EUVD-2026-62161 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Helidon are affected by EUVD-2026-62161?

Oracle Helidon 4.5.0 contains a critical authentication bypass vulnerability in its Imperative Web Server component that allows unauthenticated remote attackers to read, modify, or delete all…

How to fix or mitigate EUVD-2026-62161?

Within 24 hours, identify all systems running Oracle Helidon 4.5.0 and assess their network exposure to untrusted users. Within 7 days, implement interim controls including network isolation of Helidon services, deployment of Web Application Firewall rules to filter suspicious requests, and enhanced logging of data access attempts. Within 30 days, obtain and apply the Oracle Critical Patch Update from August 2026 or upgrade to a patched Helidon version, then validate the fix through security testing before returning systems to full production use.

Oracle Helidon EUVD-2026-62161

| CVE-2026-73917 CRITICAL

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-pq4w-6f49-j98c

Authentication Bypass Oracle Helidon

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Remote HTTP, no auth and no interaction per the authentication-bypass class (AV:N/AC:L/PR:N/UI:N); full data read and write give C:H/I:H, no service disruption so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:01 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Helidon 4.5.0 HTTP endpoint

Delivery

Send crafted request bypassing auth

Exploit

Reach protected handler as anonymous

Execution

Read sensitive application data

Impact

Create/modify/delete critical records

Access

Identify exposed Helidon 4.5.0 HTTP endpoint

Delivery

Send crafted request bypassing auth

Exploit

Reach protected handler as anonymous

Execution

Read sensitive application data

Impact

Create/modify/delete critical records

Vulnerability AssessmentAI

Exploitation	Requires a network-reachable Oracle Helidon 4.5.0 deployment using the Imperative Web Server component (Helidon SE/WebServer HTTP stack) with endpoints exposed over HTTP; per the vendor 'Authentication Bypass' tag, the target application relies on Helidon's request-handling/security layer to gate access to data or mutating operations. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals align toward genuine high priority: the CVSS vector is AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no privileges, no user interaction - the easiest-to-reach profile, consistent with Oracle's 'easily exploitable' wording. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker on the network sends a crafted HTTP request directly to an exposed Helidon 4.5.0 endpoint that should be authentication-protected, and because the Imperative Web Server fails to enforce access control, the request succeeds without any credentials. The attacker then reads sensitive application data and issues further requests to create, alter, or delete records. …
Remediation	Apply the fixes in the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html) - Patch available per vendor advisory; a specific fixed Helidon version number was not included in the provided data, so obtain the exact patched release from the CPU matrix before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.