Oracle disclosed CVE-2026-73924, a critical-severity vulnerability in the Helidon component of Oracle Fusion Middleware that lets an unauthenticated remote attacker fully read and modify data accessible to Helidon over HTTP.
What Is It
The flaw sits in the Imperative Web Server component of Oracle Helidon, part of the Oracle Fusion Middleware stack. Per Oracle's advisory, it is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Helidon. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, or all Helidon-accessible data, as well as unauthorized access to critical data or complete access to all Helidon-accessible data.
Oracle, as the assigning CNA, rates the issue 9.1 (CRITICAL) under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, giving an exploitability subscore of 3.9 (the maximum) and an impact subscore of 5.2. These figures are vendor-supplied; NVD has not yet published its own analysis, so treat the score and subscores as provisional until NVD completes enrichment. Under the vendor vector, confidentiality and integrity impacts are both HIGH and availability is not affected.
Why It Matters
Every barrier to exploitation is absent. Network attack vector, low attack complexity, no privileges required, no user interaction. That combination is the profile attackers scan for indiscriminately, and Helidon is a server-side framework typically exposed to handle inbound HTTP traffic.
There is no CISA KEV entry for CVE-2026-73924 at this time, so active exploitation has not been confirmed by CISA, the CVE does not appear in the KEV catalog as of this writing (see Sources; the catalog is updated continuously, so re-check before relying on that status). Absence from KEV is not evidence of safety, the CVE was published 2026-08-18 and NVD status remains "Received," meaning analysis is still pending.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Helidon (Oracle Fusion Middleware)
- Component: Imperative Web Server
- Affected version: 1.4.19 (the supported version listed as affected)
No CPE entries have been assigned yet, so automated asset-matching tools may not flag affected hosts. Inventory Helidon deployments manually against the version above.
Patch Status
The vulnerability is addressed in Oracle's Critical Patch Update advisory for August 2026, published at the canonical path https://www.oracle.com/security-alerts/cpuaug2026.html. No specific fixed version number is stated in the CVE record itself. Administrators running Helidon 1.4.19 should consult that advisory and apply the applicable Fusion Middleware patch; if the direct link does not resolve, navigate from Oracle's Security Alerts index. No workarounds or mitigations are documented in the supplied source material.
Sources
- NVD, CVE-2026-73924: https://nvd.nist.gov/vuln/detail/CVE-2026-73924
- Oracle Critical Patch Update Advisory; August 2026: https://www.oracle.com/security-alerts/cpuaug2026.html
- Oracle Security Alerts index: https://www.oracle.com/security-alerts/
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog