CVE-2026-73921

Modified Modified - Updated After Analysis

Remote Code Execution in Helidon

Publication date: 2026-08-18

Last updated on: 2026-08-28

Assigner: Oracle

Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-28

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-73921

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	helidon	1.4.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a critical vulnerability in Oracle Helidon 1.4.20's Imperative Web Server. It allows unauthenticated attackers to remotely compromise the system via HTTP, potentially leading to full system takeover. The vulnerability has a CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Detection Guidance

Detecting this vulnerability requires checking if your system is running Oracle Helidon version 1.4.20. Use commands like 'curl -s http://<target>:<port> | grep Helidon' or inspect server headers for Helidon version details. Network scans with tools like Nmap may also identify vulnerable services.

Impact Analysis

If you use Oracle Helidon 1.4.20, an attacker could exploit this to gain complete control over your system. This could lead to data theft, system damage, or disruption of services. The vulnerability is easily exploitable over the network without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations using affected Helidon versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately upgrade Oracle Helidon to a version later than 1.4.20. If upgrading is not possible, apply network-level mitigations such as restricting HTTP access via firewalls or disabling the Imperative Web Server component until patched.

Hi! I’m here to help you understand CVE-2026-73921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70