CVE-2026-83480: Medium severity Oracle Helidon vulnerability

Q: Who is exposed to this issue?

Helidon deployments running affected supported versions 4.0.0 through 4.5.4 are exposed if an attacker can reach the service over HTTP. No authentication or user interaction is required.

Q: What does an attacker need to exploit it?

An unauthenticated attacker needs network access to the affected Helidon service via HTTP. The vulnerability is rated low complexity and can be exploited remotely.

Q: What is the expected impact of successful exploitation?

Successful exploitation can cause a partial denial of service in Helidon. The provided CVSS vector indicates no confidentiality or integrity impact.

Published Sep 15, 2026

Updated

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Affected Software

2 affected components

Oracle Helidon>=4.0.0<=4.5.4

Event History

Sep 15, 2026

CVE Published

via MITRE·08:05 PM

Data Sourced

via MITRE·08:05 PM

DescriptionSeverity

Data Sourced

via NVD·08:18 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Helidon deployments running affected supported versions 4.0.0 through 4.5.4 are exposed if an attacker can reach the service over HTTP. No authentication or user interaction is required.

What does an attacker need to exploit it?

An unauthenticated attacker needs network access to the affected Helidon service via HTTP. The vulnerability is rated low complexity and can be exploited remotely.

What is the expected impact of successful exploitation?