CVE-2026-73896

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile - higher than 27% of all known CVEs

Summary

A vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server) affects versions 4.0.0-4.4.1. It is easily exploitable by an unauthenticated attacker with network access via HTTP/2, potentially leading to unauthorized read access to a subset of data and partial denial of service. CVSS 3.1 Base Score is 6.5 (Confidentiality and Availability impacts).

Risk Assessment

An attacker can gain unauthorized access to a subset of data and cause partial unavailability of the service, potentially compromising information confidentiality and affecting application availability.

Recommendation

It is recommended to upgrade Helidon to a version newer than 4.4.1 if a patch is available. Restrict network access to the server and monitor traffic for anomalies.

Other vulnerabilities in Helidon

See all

Original NVD description (English source)

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS