CVE-2026-73917: Oracle Helidon Auth Bypass Vulnerability

CVE-2026-73917 Overview

CVE-2026-73917 is a critical access control vulnerability [CWE-284] in the Imperative Web Server component of Oracle Helidon, part of Oracle Fusion Middleware. The affected version is Helidon 4.5.0. An unauthenticated attacker with network access via HTTP can compromise the Helidon runtime without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of all Helidon-accessible data, and unauthorized read access to that data. Oracle addressed the flaw in the August 2026 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can read and modify all data accessible to a Helidon application over HTTP.

Affected Products

Oracle Helidon 4.5.0
Oracle Fusion Middleware deployments embedding Helidon Imperative Web Server
Applications built on the Helidon SE Imperative Web Server APIs

Discovery Timeline

2026-08-18 - CVE-2026-73917 published to the National Vulnerability Database (NVD)
2026-08-21 - NVD record last modified
August 2026 - Oracle publishes fix in the Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-73917

Vulnerability Analysis

The vulnerability sits in the Imperative Web Server component of Helidon, Oracle's microservices framework for Java. The weakness is classified as improper access control [CWE-284]. An attacker sends crafted HTTP requests to a Helidon endpoint and reaches functionality or data that should be restricted. No credentials, tokens, or user interaction are required to trigger the flaw.

The scope of impact covers both confidentiality and integrity. An attacker can read sensitive data handled by the server and write, alter, or delete records the application manages. Availability is not directly affected, but integrity loss on stored data can cascade into service failures.

Because Helidon frequently fronts backend services and databases in Oracle Fusion Middleware topologies, exploitation can expose downstream systems. Any Helidon 4.5.0 instance exposed to untrusted networks should be treated as reachable by unauthenticated attackers.

Root Cause

The underlying defect is an access control gap in how the Imperative Web Server evaluates requests against protected resources. Oracle has not released implementation-level details beyond the advisory. The CWE-284 classification indicates that authorization checks are either missing or improperly enforced on the affected code path.

Attack Vector

The attack vector is network-based HTTP. An attacker with reachability to the Helidon listener sends specifically crafted requests to trigger unauthorized operations. Exploit complexity is low, no privileges are required, and no user interaction is involved. Public proof-of-concept code is not available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability stands at 0.377%.

No verified exploit code is public. Refer to the Oracle Security Alert for advisory-level detail.

Detection Methods for CVE-2026-73917

Indicators of Compromise

Unauthenticated HTTP requests to Helidon endpoints that return data normally requiring authorization
Unexpected write, update, or delete operations in application logs originating from external IP addresses
Anomalous response codes (200 OK) on endpoints that historically returned 401 or 403
Requests to Helidon admin or internal routes from outside management network ranges

Detection Strategies

Compare current HTTP access patterns against a baseline of authenticated request volumes per endpoint
Alert on requests that reach sensitive Helidon routes without an Authorization header or session cookie
Correlate application-tier data modification events with HTTP request logs to identify unauthorized writers
Monitor for scanning behavior targeting Helidon default paths and Fusion Middleware fingerprints

Monitoring Recommendations

Forward Helidon access logs and application logs to a centralized SIEM for retention and correlation
Enable request-level auditing on data mutation endpoints, including source IP and identity claims
Track version banners and CPE inventory to identify remaining Helidon 4.5.0 instances
Review egress and lateral traffic from Helidon hosts for signs of post-exploitation activity

How to Mitigate CVE-2026-73917

Immediate Actions Required

Apply the fix from the Oracle August 2026 Critical Patch Update to every Helidon 4.5.0 deployment
Inventory Fusion Middleware assets to confirm every embedded Helidon runtime is accounted for
Restrict inbound HTTP access to Helidon services to trusted networks until patching completes
Rotate credentials and API keys accessible to Helidon applications if exploitation is suspected

Patch Information

Oracle released the fix as part of the August 2026 Critical Patch Update. Administrators should upgrade Helidon beyond version 4.5.0 to the version specified in the Oracle advisory. Consult the Oracle Security Alert for exact fixed-version numbers and download instructions.

Workarounds

Place Helidon endpoints behind an authenticating reverse proxy or API gateway that enforces access control
Apply web application firewall rules that block unauthenticated access to sensitive route prefixes
Segment Helidon services on internal networks and disallow direct public exposure until patched
Disable non-essential Imperative Web Server routes if the application does not require them

bash

# Example: restrict Helidon listener to loopback until patched, then front with an authenticating proxy
# helidon config (application.yaml)
server:
  host: "127.0.0.1"
  port: 8080