CVE-2026-101571: Medium severity Oracle Helidon vulnerability
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper). Supported versions that are affected are 3.0.0-3.2.21 and 4.0.0-4.5.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Helidon executes to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected supported versions are Helidon 3.0.0 through 3.2.21 and 4.0.0 through 4.5.5, specifically in the helidon-security-providers-idcs-mapper component.
What access does an attacker need?
An attacker needs a logon and low-level privileges on the infrastructure where Helidon runs. Exploitation is local and rated difficult, with no user interaction required.
What is the potential impact of successful exploitation?
A successful attack can provide unauthorized access to critical data or complete access to data accessible to Helidon. The scope change indicates that impacts may significantly affect additional products.