EUVD-2026-62166
GHSA-x5mh-jf8q-6w72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-reachable Helidon endpoint
-
DeliverySend crafted HTTP request
-
ExploitBypass authentication on Imperative Web Server
-
ExecutionRead or modify all accessible data
-
ImpactExfiltrate or tamper with critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP reachability to a Helidon 1.4.19 instance running the Imperative Web Server (Helidon SE WebServer) component; per the CVSS vector PR:N/UI:N/AC:L, no authentication, no user interaction, and no special preconditions are needed against an exposed listener. What limits exploitation is deployment posture rather than attacker capability: instances not reachable from untrusted networks (bound to localhost, behind an authenticating gateway, or firewalled) are not remotely exploitable, and only version 1.4.19 is confirmed affected in the source data. No non-default configuration flag is cited as a prerequisite, so default network-exposed deployments should be considered at risk. |
| Impact | This is a genuine high priority, not a paper-high score: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N gives an unauthenticated, network-reachable, low-complexity attack with no user interaction, and the 9.1 base score is driven by combined high confidentiality and integrity impact (C:H/I:H) with no availability loss (A:N). Signals are mostly one-directional toward urgency, but some are missing: there is no CISA KEV listing and no public proof-of-concept in the provided data, and EPSS/SSVC values were not supplied, so exploitation-probability and automatability cannot be quantified from this input. Given a fresh Oracle Critical Patch Update disclosure with no observed exploitation yet, any organization running Helidon 1.4.19 in an internet-facing or lak-of-trust-boundary role should treat this as urgent and patch on the emergency track, while noting the absence of KEV/POC means the current threat is potential rather than confirmed in-the-wild activity. |
| Exploit ScenarioDerived | An attacker who can reach the Helidon HTTP endpoint over the network sends a specially crafted request that bypasses the intended authentication/authorization on the Imperative Web Server, then reads and tampers with any data the service can access without ever presenting valid credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no user interaction; no public exploit code is identified in the provided data, so exploitation would currently require independent research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
RemediationAI
Apply the fix from the Oracle Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html); this is the primary and vendor-supported remediation. Patch available per vendor advisory - the input does not specify an exact fixed Helidon build number, so consult the CPU matrix for the precise patched version and apply it rather than assuming a version string. As interim compensating controls until patching, place the Helidon service behind an authenticating reverse proxy or API gateway and restrict network exposure so the HTTP listener is not reachable from untrusted networks, and add WAF/proxy rules to enforce authentication and authorization in front of sensitive routes; the trade-off is that proxy-level controls may not fully replicate the intended in-app authorization logic and could break legitimate clients if route rules are too broad, so test before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Helidon is Oracle's open-source Java framework for building lightweight microservices; the affected 'Imperative Web Server' refers to Helidon SE's programmatic WebServer/routing API (as opposed to the declarative MicroProfile model in Helidon MP). The vulnerability sits in the request-handling/routing layer that fronts application endpoints, and Oracle's own 'Authentication Bypass' tag points to a flaw that allows requests to reach or act on protected data without passing intended access controls. No CWE was assigned in the source data, so the precise weakness class (e.g., improper authentication, path/route confusion, or access-control bypass) cannot be confirmed from the input alone; the impact profile (full read/write to all accessible data, no availability effect) is consistent with an authorization/authentication bypass rather than memory corruption.
Know when Helidon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated remote HTTP with low complexity and no user interaction (AV:N/AC:L/PR:N/UI:N); full read/write to accessible data gives C:H/I:H, and no availability effect is described so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Helidon 1.4.19 contains a critical vulnerability (CVE-2026-73922) allowing unauthorized remote users to read, modify, and delete application data without providing credentials. Any organization running this web server version faces immediate risk of data theft and corruption. With no vendor patch currently available, rapid deployment of defensive controls is essential.
Implement network segmentation to restrict access to Helidon instances from untrusted networks; deploy WAF rules targeting abnormal HTTP patterns; enforce mandatory authentication at upstream reverse proxy or API gateway; enable comprehensive audit logging of data access and modifications; establish 24/7 monitoring for suspicious data operations; consider temporary application relocation or architectural changes to isolate the vulnerable component until vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attac
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthentic
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an u
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthe
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server c
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imper
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middle
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an una
Exploit-DB