A critical, easily exploitable flaw in Oracle Helidon's Imperative Web Server component lets unauthenticated attackers read and modify all Helidon-accessible data over HTTP, scoring CVSS 9.1.
What Is It
CVE-2026-73922 is a vulnerability in the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. Oracle describes it as an easily exploitable vulnerability allowing an unauthenticated attacker with network access via HTTP to compromise Helidon.
Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Helidon-accessible data, as well as unauthorized access to critical data or complete access to all Helidon-accessible data.
Oracle, as the assigning CNA, rates the CVSS 3.1 base score at 9.1 (CRITICAL), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, network attack vector, low attack complexity, no privileges required, and no user interaction. Confidentiality and integrity impacts are both HIGH; availability is unaffected. NVD has not yet published its own analysis of the record, so these metrics are the vendor's.
Why It Matters
The exploitability score is a maximum 3.9. There is no authentication barrier, no user interaction requirement, and the attack is delivered over ordinary HTTP, the same channel the server exists to serve. Any exposed Helidon instance running an affected version is reachable by anyone who can route packets to it.
Combined HIGH confidentiality and integrity impact means an attacker is not limited to reading data; they can create, delete, or modify it. For a middleware layer fronting application data, that is full compromise of the data the service can reach.
No KEV entry, exploitation evidence, or federal remediation deadline accompanies the source material for this record. That absence is not itself a confirmation of non-listing; defenders who need a definitive answer should query the CISA Known Exploited Vulnerabilities catalog directly, since it is updated independently of the CVE record.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Helidon (Oracle Fusion Middleware)
- Component: Imperative Web Server, per the CVE record
- Affected version: listed in the record as supported version 1.4.19
The component-to-version pairing above is reproduced as published and has not been independently corroborated; the affected-versions matrix in Oracle's Critical Patch Update advisory is the authoritative statement of which Helidon releases are in scope. Operators should confirm their deployed version against that matrix rather than against this record. No CPE match data was published with the CVE.
Patch Status
The record was published 2026-08-18 with a vulnerability status of "Received," meaning NVD analysis is still pending. The sole reference is Oracle's Critical Patch Update advisory for July 2026, which is the authoritative source for the fix. Oracle ships Critical Patch Updates on a quarterly cycle, January, April, July, and October, so July 2026 is the most recent release, and operators should watch the October 2026 CPU for any follow-on fixes. Operators running Helidon should consult the July advisory, determine whether their release falls within the affected range, and apply the corresponding patch.
Sources
- Oracle Critical Patch Update Advisory (July 2026), https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-73922, https://nvd.nist.gov/vuln/detail/CVE-2026-73922