CVE-2026-60853: Infoleak
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.19. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate unauthorized HTTP network access to the Helidon Imperative Web Server by restricting access (e.g., firewall/ACL) to only trusted networks/clients until patched.
Event History
Frequently Asked Questions
Which deployments are affected?
The affected supported version is Oracle Helidon Imperative Web Server 3.2.20. The issue is reachable over HTTP, so deployments that expose the server to network clients are within the stated attack surface.
Does an attacker need credentials or user interaction?
No. The vulnerability can be exploited by an unauthenticated attacker with network access via HTTP, and it does not require user interaction. Exploitation is described as difficult, reflecting the high attack complexity.
What is the potential impact of successful exploitation?
A successful attack can provide unauthorized read access to a subset of data accessible through Helidon. The stated impact is limited to confidentiality; no integrity or availability impact is identified.