An easily exploitable, unauthenticated network vulnerability in the helidon-microprofile-security component of Oracle Helidon 4.0.0 through 4.5.5 lets attackers read, create, modify or delete data that Helidon can access. NVD rates it CVSS 9.1 (Critical).
What Is It
CVE-2026-101590 is a vulnerability in Oracle Helidon, part of Oracle Fusion Middleware. It affects the helidon-microprofile-security component. Oracle says the flaw is "easily exploitable" and lets an unauthenticated attacker with network access over HTTP compromise Helidon.
Oracle assigned a CVSS 3.1 base score of 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The record was published to NVD on 2026-10-20 and is in "Received" status, which means NVD has not yet completed its analysis.
Why It Matters
The CVSS metrics describe a flaw that is easy to reach and exploit:
- Attack vector: Network (HTTP)
- Attack complexity: Low
- Privileges required: None
- User interaction: None
If an attack succeeds, the impact is severe. Oracle says an attacker can gain unauthorized creation, deletion or modification access to critical data or all Helidon-accessible data. They can also gain unauthorized access to critical data or complete access to all Helidon-accessible data. Confidentiality and integrity impacts are both rated High. Availability impact is rated None.
The component is a security module, so applications that rely on it to enforce authentication or authorization may be exposed to attackers who are not logged in.
CISA's Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE, so CISA has not confirmed active exploitation. The supplied source material includes no public reports of exploitation.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Helidon (Oracle Fusion Middleware)
- Component: helidon-microprofile-security
- Affected versions: 4.0.0 through 4.5.5 (inclusive)
Oracle's description covers only supported versions. NVD has not yet published CPE entries for this record.
Patch Status
Oracle disclosed this vulnerability in its October 2026 Critical Patch Update (CPU), the only reference in the NVD record. Organizations running Helidon 4.0.0 through 4.5.5 should check that advisory for the fixed release and remediation guidance, then apply the update promptly.
Because there is no KEV entry, no CISA remediation deadline or required action applies. Given the critical score, the lack of an authentication requirement and the low attack complexity, internet-facing Helidon services should be patched first.