CVE-2026-73887: Oracle Helidon Auth Bypass Vulnerability

CVE-2026-73887 Overview

CVE-2026-73887 is an improper access control vulnerability [CWE-284] in the Imperative Web Server component of Oracle Helidon, part of Oracle Fusion Middleware. The affected version is Helidon 4.5.0. An unauthenticated attacker with network access over HTTP/2 can exploit the flaw without user interaction. Successful exploitation results in unauthorized read access to critical data or complete access to all Helidon-accessible data. The vulnerability affects confidentiality only, with no impact on integrity or availability. Oracle published the fix as part of the August 2026 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can access all data handled by a vulnerable Helidon 4.5.0 Imperative Web Server via HTTP/2 requests.

Affected Products

Oracle Helidon 4.5.0 (Imperative Web Server component)
Oracle Fusion Middleware deployments embedding Helidon 4.5.0
Java microservices built on the Helidon 4.5.0 SE Imperative Web Server API

Discovery Timeline

2026-08-18 - CVE-2026-73887 published to the National Vulnerability Database
2026-08-18 - Oracle Security Alert / Critical Patch Update disclosure (Oracle Security Alert August 2026)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73887

Vulnerability Analysis

The vulnerability resides in the Imperative Web Server component of Oracle Helidon 4.5.0, a Java microservices framework. Helidon exposes both reactive and imperative server APIs; the imperative variant handles requests on virtual threads and supports HTTP/2 by default. Improper access control [CWE-284] on the HTTP/2 request path allows a remote attacker to reach protected resources or bypass server-enforced authorization checks. No credentials, user interaction, or elevated privileges are required to trigger the flaw.

Exploitation is limited to disclosure of confidential data. An attacker cannot modify server state or degrade availability through this specific flaw. However, in production deployments, the exposed data typically includes application secrets, tokens, session material, and business records processed through Helidon endpoints. The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation at a low percentile, and no public proof-of-concept has been observed.

Root Cause

The root cause is missing or insufficient access control enforcement on the HTTP/2 request-handling path in Helidon's Imperative Web Server. Access decisions that apply to HTTP/1.1 requests are not consistently applied when a client negotiates HTTP/2, allowing requests to bypass intended restrictions.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP/2 requests directly to the Helidon Imperative Web Server or through any upstream proxy that forwards HTTP/2 traffic. Because attack complexity is low and no authentication is required, exposure of a vulnerable Helidon instance on any reachable network makes exploitation viable. See the Oracle Security Alert August 2026 for vendor-provided technical context; Oracle does not publish exploit specifics.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert for authoritative technical detail.

Detection Methods for CVE-2026-73887

Indicators of Compromise

Unauthenticated HTTP/2 requests to Helidon endpoints returning HTTP 200 responses for resources that normally require authentication.
Anomalous response sizes on Helidon service endpoints, indicating bulk data reads by unauthenticated clients.
Client-initiated HTTP/2 connections from unexpected source IP ranges or geographic regions targeting internal Helidon service ports.

Detection Strategies

Inspect Helidon access logs for HTTP/2 requests (:scheme, :method, :path pseudo-headers) that reach protected paths without a corresponding Authorization header or session cookie.
Baseline expected callers per Helidon service and alert on new source identities issuing HTTP/2 GET requests at high volume.
Correlate reverse-proxy and Helidon logs to identify requests that bypass proxy-enforced authentication when HTTP/2 upgrade is negotiated end-to-end.

Monitoring Recommendations

Enable verbose request logging on Helidon 4.5.0 instances until patched, including protocol version and authenticated principal fields.
Forward Helidon and fronting proxy logs to a centralized analytics pipeline for correlation and long-window retention.
Deploy network monitoring for HTTP/2 traffic patterns to Java microservice ports, and alert on unauthenticated access to sensitive routes.

How to Mitigate CVE-2026-73887

Immediate Actions Required

Inventory all Helidon 4.5.0 deployments, including embedded uses inside Oracle Fusion Middleware products and internal Java microservices.
Apply the fixes provided in the Oracle Security Alert August 2026 to every affected instance.
Restrict network exposure of Helidon services to trusted client ranges until patching is complete.
Rotate credentials, API keys, and session tokens that may have been served by exposed Helidon endpoints.

Patch Information

Oracle released the fix for CVE-2026-73887 as part of the August 2026 Critical Patch Update. Upgrade Helidon to the fixed release identified in the Oracle advisory and redeploy dependent Fusion Middleware components. Review the Oracle Security Alert August 2026 for the exact fixed version and any component-specific instructions.

Workarounds

Disable HTTP/2 support on Helidon Imperative Web Server listeners and force clients to HTTP/1.1 where feasible.
Terminate HTTP/2 at an upstream reverse proxy or API gateway that enforces authentication before forwarding requests as HTTP/1.1 to Helidon.
Enforce mutual TLS or network-level allowlisting on Helidon service ports until the patched release is deployed.

bash

# Configuration example: disable HTTP/2 on a Helidon 4.x server via application.yaml
server:
  port: 8080
  protocols:
    http_1_1:
      enabled: true
    http_2:
      enabled: false