CVE-2026-71164: Critical severity Oracle Helidon vulnerability
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If you cannot patch immediately, restrict network access to the Helidon Imperative Web Server (HTTP) so that unauthenticated attackers cannot reach it (e.g., block HTTP/port access at the network level or firewall to only trusted sources).
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Oracle Helidon deployments using the Imperative Web Server component in the supported affected version 3.2.18 are exposed when they are reachable over HTTP from an attacker’s network location.
Does exploitation require credentials or user interaction?
No. The vulnerability is described as easily exploitable by an unauthenticated attacker with network access via HTTP, and it requires no user interaction.
What could an attacker achieve if exploitation succeeds?
Successful exploitation can result in takeover of Helidon, with high confidentiality, integrity, and availability impact.