CVE-2026-71065

Modified Modified - Updated After Analysis

Unauthenticated Access in Oracle Helidon

Publication date: 2026-08-18

Last updated on: 2026-08-28

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data as well as unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-28

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-71065

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	helidon	3.2.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Fusion Middleware's Helidon product, specifically in the Imperative Web Server component. The affected version is 3.2.18. An unauthenticated attacker can exploit it remotely via HTTP to gain unauthorized access to critical data or all accessible data in Helidon. It may also allow unauthorized modifications to some data. The vulnerability has a high impact on confidentiality and moderate impact on integrity, with a CVSS score of 9.3.

Detection Guidance

Since no specific detection methods or commands are provided in the CVE details, general approaches include checking for vulnerable Helidon versions (3.2.18) and monitoring HTTP traffic for unusual access patterns. Ensure your Helidon instances are updated beyond 3.2.18 and review server logs for unauthorized access attempts.

Impact Analysis

If you use Helidon 3.2.18, an attacker could access sensitive data, modify some data, or delete data without authentication. This could lead to data breaches, loss of sensitive information, or unauthorized changes to your systems. The impact is significant due to the high confidentiality risk and potential for data manipulation.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data access or modification. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach could result in legal penalties, fines, or reputational damage for failing to meet these regulatory requirements.

Mitigation Strategies

Immediately update Helidon to a version that is not affected by this vulnerability. If an update is not available, consider disabling the Imperative Web Server component or restricting network access to it via firewall rules until a patch is applied.

Hi! I’m here to help you understand CVE-2026-71065. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70