CVE-2026-101582

Received Received - Intake

Unauthenticated Data Read in Oracle Helidon

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integrations-vault). Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-101582

Affected Vendors & Products

Vendor	Product	Version / Range
Oracle	Corporation	Helidon 4.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Fusion Middleware's Helidon product, specifically in the helidon-integrations-vault component. It affects versions 4.0.0 to 4.5.5. An unauthenticated attacker can exploit it remotely via HTTP to gain unauthorized read access to some Helidon data.

Impact Analysis

An attacker could access sensitive data stored in Helidon, potentially leading to data breaches. This may expose confidential information, though the impact is limited to a subset of accessible data.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate GDPR, HIPAA, or other privacy regulations. Organizations using affected Helidon versions may face compliance violations and potential penalties.

Mitigation Strategies

Update Helidon to a version beyond 4.5.5 as the vulnerability affects versions 4.0.0 to 4.5.5. Restrict network access to HTTP ports used by Helidon to limit exposure. Monitor for unauthorized data access attempts.

Hi! I’m here to help you understand CVE-2026-101582. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70