CVE-2026-73888: Medium severity Oracle Helidon (Imperative Web Server) vulnerability
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Helidon (Imperative Web Server)to a version that resolves this vulnerability.Fixed in 4.4.1 - Compensating control
Restrict network access to the Helidon HTTP endpoint (Imperative Web Server) to prevent unauthenticated remote exploitation.
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker with network access to the affected Helidon Imperative Web Server over HTTP can exploit it. No user interaction or prior privileges are required.
What versions and configurations are known to be affected?
The affected supported version identified is Oracle Helidon Imperative Web Server 4.5.0. The available information does not state that any non-default configuration is required.
What is the likely impact of successful exploitation?
Successful exploitation can give an attacker unauthorized read access to a subset of data accessible through Helidon. The stated CVSS impacts are limited to confidentiality; integrity and availability impacts are not identified.
How can I determine whether I am affected?
Identify Helidon Imperative Web Server deployments and verify whether they run supported version 4.5.0 and are reachable over HTTP from untrusted networks. The provided information does not include indicators of compromise or a detection method.