What is the CVSS score of EUVD-2026-62177?

EUVD-2026-62177 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Helidon are affected by EUVD-2026-62177?

Oracle Helidon 3.2.19 is vulnerable to remote denial-of-service attacks from any network source, with no authentication required; no public exploit identified at time of analysis, but the ease of…

How to fix or mitigate EUVD-2026-62177?

Within 24 hours, conduct an inventory sweep to identify all systems running Oracle Helidon 3.2.19 and assess which are customer-facing or business-critical; simultaneously implement network-level HTTP/2 traffic restrictions and reverse-proxy rate limiting to increase attack friction. Within 7 days, complete the full inventory across development, staging, and production environments, categorize systems by criticality, and validate that compensating controls are functioning. Within 30 days, upgrade all affected systems to an unaffected version of Oracle Helidon; for systems requiring maximum availability, prioritize those with compensating controls in place and schedule upgrades during maintenance windows.

Oracle Helidon EUVD-2026-62177

| CVE-2026-73934 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-v5fm-6cc7-pc4m

Oracle Authentication Bypass Helidon

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

HTTP/2 endpoint is network-reachable with no auth; impact is availability-only via crash or hang, with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 21:54 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed Helidon HTTP/2 endpoint

Delivery

Send crafted HTTP/2 request sequence

Exploit

Trigger unhandled state in Imperative Web Server

Execution

Cause complete hang or process crash

Impact

Repeat to sustain denial of service

Access

Identify exposed Helidon HTTP/2 endpoint

Delivery

Send crafted HTTP/2 request sequence

Exploit

Trigger unhandled state in Imperative Web Server

Execution

Cause complete hang or process crash

Impact

Repeat to sustain denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires network access to the Helidon Imperative Web Server over the HTTP/2 protocol - no authentication, no special permissions, and no user interaction are needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately captures an easily exploitable, unauthenticated network-reachable DoS - a profile that demands prompt remediation for any internet-facing or intranet-accessible Helidon deployment; even a mid-sized municipal IT team in gliwice running Helidon-based microservices should treat this as an operational priority rather than a deferred patch. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated remote attacker sends a sequence of crafted HTTP/2 requests to an exposed Helidon 3.2.19 Imperative Web Server endpoint, triggering a hang or repeated crash of the server process. Because no authentication is required and attack complexity is low, the scenario is repeatable and does not require prior foothold - a script sending malformed HTTP/2 frames or exploiting a specific protocol-level condition would suffice. …
Remediation	The primary remediation is to apply the patch issued by Oracle as part of the Critical Security Patch Update for August 2026, detailed at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct an inventory sweep to identify all systems running Oracle Helidon 3.2.19 and assess which are customer-facing or business-critical; simultaneously implement network-level HTTP/2 traffic restrictions and reverse-proxy rate limiting to increase attack friction. …

Threat intelligence, references, and detailed analysis are available after sign-in.