CVE-2026-101568

Analyzed Analyzed - Analysis Complete

Unauthenticated Data Read in Oracle Helidon

Publication date: 2026-10-20

Last updated on: 2026-11-09

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-health). Supported versions that are affected are 3.0.0-3.2.21, 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-11-09

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-101568

EUVD

EUVD-2026-105976

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	helidon	From 4.0.0 (inc) to 4.5.5 (inc)
oracle	helidon	27.0.0
oracle	helidon	From 3.0.0 (inc) to 3.2.21 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Fusion Middleware's Helidon product, specifically the helidon-health component. It allows unauthenticated attackers with network access via HTTP to read a subset of data accessible by Helidon. The impact is limited to unauthorized read access without affecting integrity or availability.

Detection Guidance

To detect this vulnerability, check if your Helidon versions fall within the affected ranges (3.0.0-3.2.21, 4.0.0-4.5.5, or 27.0.0). Inspect network traffic for unauthorized HTTP access attempts targeting Helidon services. Monitor logs for unusual read access patterns to Helidon data.

Impact Analysis

If you use affected versions of Helidon (3.0.0-3.2.21, 4.0.0-4.5.5, or 27.0.0), an attacker could exploit this to access sensitive data without authentication. This may lead to data breaches or unauthorized information disclosure.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization. For HIPAA, it may compromise protected health information if accessed. Compliance failures could result in legal penalties or fines.

Mitigation Strategies

Update Helidon to a version not affected by this vulnerability. Affected versions are 3.0.0-3.2.21, 4.0.0-4.5.5, and 27.0.0. Apply patches or upgrades as soon as possible to address the issue.

Hi! I’m here to help you understand CVE-2026-101568. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...