CVE-2026-73884: Infoleak
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Helidon Imperative Web Server (Oracle Fusion Middleware)to a version that resolves this vulnerability.Fixed in 4.4.1 - Compensating control
Restrict network access to the Helidon HTTP endpoint (Imperative Web Server) so unauthenticated attackers cannot reach it over the network.
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Deployments using the Helidon Imperative Web Server in supported version 4.5.0 are affected. The vulnerable service is exposed to attackers who have network access to it over HTTP.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker can exploit the issue remotely over HTTP, and no user interaction is required.
What is the likely impact of a successful attack?
A successful attack can provide unauthorized access to critical data or complete access to all data accessible through Helidon. The stated impact is confidentiality only; integrity and availability impacts are rated none.