Oracle Helidon EUVD-2026-62162

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms that exploitation requires only network-level HTTP access to a Helidon 4.5.0 instance running the Imperative Web Server component - no authentication credentials, user interaction, or non-default configuration is necessary. The vulnerability is version-specific: only Helidon 4.5.0 is confirmed affected; other versions of Helidon, including those using the reactive API, are not identified as vulnerable in the available data. Scope is unchanged (S:U), constraining impact to the Helidon application boundary and preventing lateral escalation to the underlying host or adjacent systems. The primary factors limiting per-attack impact are the partial C/I/A ratings (C:L/I:L/A:L): an attacker cannot fully exfiltrate all data, achieve full integrity compromise, or cause complete service disruption in a single exploitation event.

The CVSS 3.1 base score of 7.3 (High) is well-supported by the AV:N/AC:L/PR:N/UI:N vector, which collectively indicate a low-friction, unauthenticated network attack requiring no special tooling - even a mid-sized municipal IT team in leszno running microservices on Helidon 4.5.0 should treat this as urgent given that the zero-authentication network path eliminates most common mitigating factors. That said, the triple-partial impact profile (C:L/I:L/A:L) tempers the severity: no single exploitation event yields full system compromise, administrative credential theft, or remote code execution, which distinguishes this from the most critical Oracle CPU findings. No EPSS score was included in the available intelligence, preventing quantitative exploitation probability assessment; the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no proof-of-concept code has been publicly identified. The overall risk posture is genuine but measured: high network reachability with constrained per-attack impact, making this a patch-cycle priority rather than an emergency out-of-band remediation unless the Helidon instance handles sensitive data or is directly internet-facing.

An unauthenticated remote attacker with network access to a Helidon 4.5.0 Imperative Web Server instance sends a crafted HTTP request that triggers the underlying flaw in request processing or access control logic. With no authentication or user interaction required and low attack complexity, the attacker can read a subset of application-accessible data, insert or modify records within the application's data scope, and cause partial degradation of service availability. No public proof-of-concept exploit has been identified, but the straightforward CVSS vector suggests exploitation may be relatively accessible once the specific flaw mechanics are reverse-engineered from the patch.