CVE-2026-83460: Oracle Helidon LRA SQL Injection Vulnerability

CVE-2026-83460 Overview

CVE-2026-83460 is a medium-severity vulnerability in the Oracle Helidon component of Oracle Fusion Middleware, specifically within the Long Running Actions (LRA) subsystem. Affected versions span Helidon 4.0.0 through 4.5.4. An unauthenticated attacker with network access over HTTP can compromise Helidon without user interaction. Successful exploitation allows unauthorized update, insert, or delete access to a subset of Helidon-accessible data, along with unauthorized read access to a subset of that data. Oracle disclosed the issue in the Oracle Security Alert CSPUSEP2026 advisory.

Critical Impact
An unauthenticated remote attacker can modify and read a subset of data accessible to Helidon services through crafted HTTP requests to the LRA component.

Affected Products

Oracle Helidon 4.0.0 through 4.5.4
Oracle Fusion Middleware (Helidon LRA component)
Applications and microservices built on affected Helidon versions using the LRA coordinator

Discovery Timeline

2026-09-15 - CVE-2026-83460 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83460

Vulnerability Analysis

The flaw resides in the Long Running Actions (LRA) component of Oracle Helidon, a microservices framework used in Oracle Fusion Middleware deployments. LRA implements the Eclipse MicroProfile Long Running Actions specification, coordinating distributed transactions across microservices through HTTP-based participant callbacks.

The vulnerability is network-reachable and does not require authentication or user interaction. Attackers can interact with LRA endpoints over HTTP to trigger unauthorized data operations. The scope remains unchanged, meaning the impact is limited to the vulnerable Helidon component rather than crossing security boundaries.

Exploitation yields both limited confidentiality and limited integrity impact. Availability is not affected, which is consistent with a data-access flaw rather than a resource exhaustion or crash condition. The Oracle Security Alert CSPUSEP2026 advisory provides the authoritative fix guidance.

Root Cause

The root cause is insufficient access control enforcement on LRA coordinator endpoints exposed over HTTP. The LRA component processes participant lifecycle requests without adequately validating the requester or the target resource, allowing an unauthenticated caller to invoke actions that create, modify, or read state managed by Helidon.

Attack Vector

The attack vector is remote over HTTP with low complexity. An attacker sends crafted HTTP requests to LRA endpoints exposed by a Helidon service. Because no privileges or user interaction are required, any network path to the vulnerable service is sufficient for exploitation.

No verified public proof-of-concept code is available at the time of publication. The EPSS score is 0.281% (percentile 20.668), indicating a low predicted probability of near-term exploitation. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-specific technical details.

Detection Methods for CVE-2026-83460

Indicators of Compromise

Unauthenticated HTTP requests to LRA coordinator endpoints (paths typically containing /lra-coordinator or /lra) from unexpected source addresses
Unexpected creation, completion, or cancellation of LRA transactions in Helidon service logs
Data modifications in downstream services correlating with LRA participant callbacks that lack a legitimate business origin

Detection Strategies

Inventory all Helidon 4.0.0–4.5.4 deployments and identify which expose the LRA component to untrusted networks
Review HTTP access logs on Helidon services for requests to LRA endpoints originating outside authenticated client ranges
Correlate LRA participant callback traffic with expected microservice transaction patterns to surface anomalies

Monitoring Recommendations

Forward Helidon application and access logs to a centralized analytics platform for retention and correlation
Alert on HTTP 2xx responses to /lra* endpoints from source IPs outside allow-listed service meshes
Baseline normal LRA transaction volume and alert on sustained deviations that may indicate abuse

How to Mitigate CVE-2026-83460

Immediate Actions Required

Identify all Helidon deployments in versions 4.0.0 through 4.5.4 and prioritize those exposing LRA endpoints to untrusted networks
Apply the fix documented in the Oracle Security Alert CSPUSEP2026 as soon as change windows permit
Restrict network access to LRA coordinator endpoints to trusted service-mesh participants until patching is complete

Patch Information

Oracle addressed the vulnerability in the fix bundle referenced by the Oracle Security Alert CSPUSEP2026. Administrators should upgrade Helidon to the fixed release identified in that advisory and validate that the LRA component is running the patched version. Consult Oracle My Oracle Support for patch download instructions and applicability to specific Fusion Middleware bundles.

Workarounds

Place LRA endpoints behind an authenticating reverse proxy or API gateway that enforces mutual TLS or token-based authentication
Use network policies, firewall rules, or service-mesh authorization to limit LRA endpoint reachability to known participant services
Disable the LRA component in Helidon deployments that do not require distributed long-running transactions

bash

# Example: restrict LRA endpoints to an internal CIDR using iptables
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -m string --string "/lra" --algo bm -j DROP