CVE-2026-71074: Critical severity Oracle Helidon (Oracle Fusion Middleware) vulnerability

Published Aug 18, 2026

Updated

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.19 and 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Software

2 affected components

Oracle Helidon (Oracle Fusion Middleware)=3.2.18

Oracle Helidon=3.2.18

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Helidon (Oracle Fusion Middleware) - Imperative Web Server to a version that resolves this vulnerability.
Fixed in 1.4.19
Upgrade
Upgrade Helidon (Oracle Fusion Middleware) - Imperative Web Server to a version that resolves this vulnerability.
Fixed in 3.2.17

Event History

Aug 18, 2026

CVE Published

via MITRE·09:03 PM

Data Sourced

via MITRE·09:03 PM

DescriptionSeverity

Data Sourced

via NVD·09:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this vulnerability?

Helidon deployments using the affected supported version, 3.2.18, are exposed if an attacker can reach the Imperative Web Server over HTTP. No authentication or user interaction is required.

What level of access does an attacker need to exploit it?

An attacker needs network access to the vulnerable service via HTTP. The CVSS vector indicates low attack complexity, no privileges required, and no user interaction.

What could happen if exploitation succeeds?

Successful exploitation can result in takeover of Helidon, with high impact to confidentiality, integrity, and availability.