Oracle disclosed a CVSS 9.8 flaw in the Helidon component of Oracle Fusion Middleware that lets an unauthenticated remote attacker fully compromise the server over HTTP.
What Is It
CVE-2026-73921 is a vulnerability in the Helidon product of Oracle Fusion Middleware, specifically in the Imperative Web Server component. Oracle describes it as an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks result in takeover of Helidon.
The CVSS 3.1 base score is 9.8 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low attack complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity, and availability. The exploitability subscore is 3.9, the maximum for that metric.
Why It Matters
Every barrier that normally slows an attacker down is absent here. There is no authentication requirement, no user interaction, no elevated privilege needed, and the attack complexity is rated low. The reachable surface is an HTTP-facing web server component; how exposed that is depends entirely on the deployment; Helidon services sit behind reverse proxies and gateways in some environments and are directly reachable in others, so operators should determine their own exposure rather than assume either case.
The stated outcome is not data disclosure or denial of service alone; it is takeover of Helidon, with high impact across all three CIA dimensions. That places this in the class of bugs typically weaponized quickly after disclosure.
The record was published 2026-08-18 and remains in Received status, meaning NVD enrichment is not yet complete. No CISA KEV entry accompanies this CVE, so there is no confirmed active exploitation and no federal remediation deadline at this time. That status can change; treat the absence of a KEV listing as a snapshot, not an all-clear.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Helidon (Oracle Fusion Middleware)
- Component: Imperative Web Server
- Affected version: 1.4.20; the only supported version listed as affected
No CPE entries have been published for this CVE yet.
Patch Status
Oracle ships security fixes through its Critical Patch Update program, which runs on a fixed quarterly schedule; January, April, July, and October. There is no August advisory, and the CVE record was published between cycles. On that schedule, the fix would most likely be carried by the July 2026 Critical Patch Update or by the next scheduled release in October 2026, though neither has been confirmed to contain it. The CVE record itself does not state a patched version number.
Administrators running Helidon 1.4.20 should check the July 2026 CPU advisory for this CVE ID first, and monitor the October 2026 CPU if it is not listed there. The CPU advisory, not the CVE record, is the authoritative source for fixed versions and patch availability.
Sources
- Oracle Critical Patch Update Advisory (July 2026), https://www.oracle.com/security-alerts/cpujul2026.html
- Oracle Security Alerts index (quarterly CPU schedule and current advisories), https://www.oracle.com/security-alerts/
- NVD, CVE-2026-73921, https://nvd.nist.gov/vuln/detail/CVE-2026-73921
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog