Oracle has disclosed a CVSS 9.9 vulnerability in the Imperative Web Server component of Helidon 4.5.3 that, according to Oracle's own assessment, could allow an unauthenticated attacker to compromise the server over HTTP and impact adjacent products.
What Is It
CVE-2026-73930 is a vulnerability in the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. Oracle describes it as easily exploitable: an unauthenticated attacker with network access via HTTP can compromise Helidon with no privileges and no user interaction. The CVSS 3.1 base score is 9.9 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L.
The record was published by Oracle's security alert team on 2026-08-18 and currently carries NVD status "Received," meaning it has not yet completed NVD analysis. The severity characterization below reflects Oracle's supplied CVSS data rather than independent verification.
Why It Matters
The scope is marked Changed. Oracle states that while the vulnerability lives in Helidon, attacks may significantly impact additional products; meaning a successful exploit reaches beyond the vulnerable component's own security boundary. That scope change is what drives the score to 9.9 despite Low confidentiality and Low availability sub-scores.
Per Oracle, successful attacks can result in unauthorized creation, deletion, or modification of critical data or all Helidon-accessible data (High integrity impact), unauthorized read access to a subset of Helidon-accessible data, and the ability to cause a partial denial of service. The exploitability sub-score is 3.9, the maximum, reflecting network reachability, low attack complexity, and no authentication requirement.
There is no CISA KEV entry for this CVE in the supplied data, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Helidon (Oracle Fusion Middleware)
- Component: Imperative Web Server
- Affected version: 4.5.3 (the supported version listed as affected)
No CPE match data was present in the supplied record.
Patch Status
The record carries a publication date of 2026-08-18 and is attributed to Oracle's security alert team, though the supplied material does not identify the specific advisory or publication channel through which the issue was released. Note that Oracle's Critical Patch Updates ship on a fixed quarterly schedule, January, April, July, and October, so there is no August 2026 CPU; the nearest quarterly release is the July 2026 Critical Patch Update, and out-of-cycle issues are typically published as standalone Security Alerts. The supplied source material does not specify a fixed version number or a mandated remediation deadline, and does not indicate whether the fix is delivered in a CPU or a standalone alert; administrators should consult Oracle's security alerts page directly to confirm which advisory carries the applicable patch. No CISA-required action date is present in the supplied data.
Sources
- Oracle Security Alerts and Critical Patch Update advisories; https://www.oracle.com/security-alerts/
- NVD, CVE-2026-73930, https://nvd.nist.gov/vuln/detail/CVE-2026-73930