CVE-2026-73867: Oracle Helidon SQL Injection Vulnerability

CVE-2026-73867 Overview

CVE-2026-73867 is a network-exploitable vulnerability in the Imperative Web Server component of Oracle Helidon, part of Oracle Fusion Middleware. The affected release is Helidon version 3.2.18. An unauthenticated attacker with HTTP access to the server can exploit the flaw without user interaction. Successful exploitation allows unauthorized read access to a subset of Helidon-accessible data and unauthorized create, update, or delete operations on some Helidon-accessible data. Oracle documented the issue in the Oracle Security Alert August 2026.

Critical Impact
Remote, unauthenticated attackers can modify and read data served by Helidon over HTTP, undermining confidentiality and integrity of application data.

Affected Products

Oracle Helidon 3.2.18 (Oracle Fusion Middleware)
Component: Imperative Web Server
Applications built on Helidon 3.2.18 exposing HTTP endpoints

Discovery Timeline

2026-08-18 - CVE-2026-73867 published to NVD
2026-08-18 - Oracle Security Alert August 2026 references the issue
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73867

Vulnerability Analysis

The vulnerability resides in the Imperative Web Server component of Helidon, Oracle's Java microservices framework. An attacker sends crafted HTTP requests over the network to reach the vulnerable server without authenticating. The flaw does not require elevated privileges, user interaction, or specialized attack conditions. Exploitation results in partial confidentiality loss through unauthorized reads and partial integrity loss through unauthorized writes or deletes. Availability of the service is not affected according to Oracle's advisory. The scope is unchanged, meaning the impact is confined to the Helidon process boundary.

Root Cause

Oracle has not published detailed root-cause information for CVE-2026-73867 beyond identifying the Imperative Web Server component of Helidon 3.2.18. The Oracle Security Alert August 2026 is the authoritative reference for affected components and fixed versions.

Attack Vector

The attack vector is Network over HTTP. An unauthenticated remote attacker sends HTTP requests to a Helidon endpoint exposed by the Imperative Web Server. Exploitation complexity is low and no user interaction is required. Applications that expose Helidon HTTP endpoints to untrusted networks, including the public internet, are at highest risk.

No public proof-of-concept is available at the time of publication. The EPSS probability is 0.269%.

Detection Methods for CVE-2026-73867

Indicators of Compromise

Unexpected HTTP requests to Helidon endpoints from untrusted or geographically anomalous source IPs.
Unauthorized create, update, or delete operations on application resources with no corresponding authenticated session in logs.
Access log entries showing successful responses to endpoints that should require authentication.

Detection Strategies

Inventory all services running Helidon 3.2.18 and enumerate their externally reachable HTTP routes.
Correlate Helidon access logs with application-tier audit logs to identify state changes that lack an authenticated principal.
Deploy web application firewall rules to alert on unauthenticated requests targeting sensitive Helidon routes.

Monitoring Recommendations

Forward Helidon HTTP access and error logs to a centralized SIEM for retention and correlation.
Baseline normal request patterns per endpoint and alert on deviations in request volume, methods, or response codes.
Monitor outbound egress from Helidon hosts to detect follow-on data exfiltration or command-and-control activity.

How to Mitigate CVE-2026-73867

Immediate Actions Required

Identify Helidon 3.2.18 deployments and apply the fix referenced in the Oracle Security Alert August 2026.
Restrict network exposure of Helidon HTTP endpoints to trusted networks until patching completes.
Review recent Helidon access and audit logs for evidence of unauthorized reads or data modifications.

Patch Information

Oracle addresses CVE-2026-73867 in its August 2026 security alert cycle. Administrators should consult the Oracle Security Alert August 2026 for the fixed Helidon build and upgrade guidance. Apply the vendor-supplied update to all instances of Helidon 3.2.18 and rebuild dependent applications against the patched framework version.

Workarounds

Place Helidon services behind an authenticating reverse proxy or API gateway that enforces access control on all routes.
Apply network segmentation and firewall rules to limit HTTP access to Helidon instances to trusted client ranges.
Enforce least-privilege database and service accounts used by Helidon to reduce the blast radius of unauthorized writes.

bash

# Example: restrict Helidon HTTP port to an internal CIDR using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP