CVE-2026-73895

Received Received - Intake

Information Disclosure in Oracle Helidon

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-73895

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	helidon	3.2.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Fusion Middleware's Helidon product, specifically in the Imperative Web Server component. It affects version 3.2.18 and allows unauthenticated attackers to access some data through HTTP requests. The impact is limited to unauthorized read access to a subset of accessible data.

Impact Analysis

An attacker could exploit this to read sensitive data from the Helidon server without authentication. This may lead to exposure of confidential information, depending on what data the server handles. The impact is primarily on data confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized data access, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected Helidon versions must address this to maintain regulatory compliance.

Mitigation Strategies

Update Helidon to a version that is not affected by this vulnerability. If immediate update is not possible, restrict network access to the Imperative Web Server component via firewall rules or network segmentation.

Hi! I’m here to help you understand CVE-2026-73895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70