{"cve":"CVE-2026-73884","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"4.5.0"}}],"enrichment":{"confidence":95.0,"confidence_source":"inferred","scores":[{"score":95.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Helidon","source":"cna","vendor":"Oracle Corporation"},"product":"helidon","vendor":"oracle"}],"created":"2026-08-19T06:30:05.493184+00:00","updated":"2026-08-28T22:00:15.314292+00:00","vendors":["oracle","oracle$PRODUCT$helidon"]},"epss":{"score":0.00437},"mitre":{"cpes":["cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*"],"created":"2026-08-18T21:03:58.387000+00:00","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).  Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/73xxx/CVE-2026-73884.json","references":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"title":null,"updated":"2026-08-28T16:47:37.209000+00:00","vendors":["oracle","oracle$PRODUCT$helidon"],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*"],"created":"2026-08-18T21:18:20.843000+00:00","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).  Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-73884.json","references":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"title":null,"updated":"2026-08-28T20:19:47.077000+00:00","vendors":["oracle","oracle$PRODUCT$helidon"],"weaknesses":["CWE-200"]},"opencve":{"changes":[{"created":"2026-08-18T21:15:00+00:00","data":[{"details":{"new":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).   The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","old":null},"type":"description"},{"details":["oracle","oracle$PRODUCT$helidon"],"type":"first_time"},{"details":{"added":["cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["oracle","oracle$PRODUCT$helidon"],"removed":[]},"type":"vendors"},{"details":{"added":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"ec07bd98-f5cd-4d8d-abfd-96f67505daa3"},{"created":"2026-08-19T06:45:00+00:00","data":[{"details":{"new":"Unauthenticated Remote Data Access via HTTP in Oracle Helidon Imperative Web Server","old":null},"type":"title"},{"details":{"added":["CWE-284","CWE-288"],"removed":[]},"type":"weaknesses"}],"id":"f2e9f684-7f70-48ab-8d04-5a4f267c3157"},{"created":"2026-08-19T17:30:00+00:00","data":[{"details":{"new":null,"old":"Unauthenticated Remote Data Access via HTTP in Oracle Helidon Imperative Web Server"},"type":"title"},{"details":{"added":[],"removed":["CWE-284","CWE-288"]},"type":"weaknesses"}],"id":"682015e8-064b-4a84-8a07-72676f23636f"},{"created":"2026-08-20T02:15:00+00:00","data":[{"details":{"new":"Unauthenticated HTTP Access Enables Confidential Data Breach in Oracle Helidon 4.5.0","old":null},"type":"title"},{"details":{"added":["CWE-284","CWE-288"],"removed":[]},"type":"weaknesses"}],"id":"19507e28-294c-4307-998b-6ca4166a15d6"},{"created":"2026-08-20T17:15:00+00:00","data":[{"details":{"new":null,"old":"Unauthenticated HTTP Access Enables Confidential Data Breach in Oracle Helidon 4.5.0"},"type":"title"},{"details":{"added":[],"removed":["CWE-284","CWE-288"]},"type":"weaknesses"}],"id":"e09b48c8-c0ca-4f85-88a8-b452bb7c8af3"},{"created":"2026-08-20T23:00:00+00:00","data":[{"details":{"new":"Unauthenticated HTTP Access Enables Confidential Data Disclosure in Oracle Helidon 4.5.0","old":null},"type":"title"},{"details":{"added":["CWE-285"],"removed":[]},"type":"weaknesses"}],"id":"fb696057-3295-4b66-a829-f042e10176a3"},{"created":"2026-08-25T02:30:00+00:00","data":[{"details":{"added":["CWE-200"],"removed":[]},"type":"weaknesses"},{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"cbcc4efa-e0e7-4860-adb1-960a29a22133"},{"created":"2026-08-25T04:30:00+00:00","data":[{"details":{"new":null,"old":"Unauthenticated HTTP Access Enables Confidential Data Disclosure in Oracle Helidon 4.5.0"},"type":"title"},{"details":{"added":[],"removed":["CWE-285"]},"type":"weaknesses"}],"id":"da2b9fcb-54a0-4d46-9e22-817ac411afb2"},{"created":"2026-08-25T05:45:00+00:00","data":[{"details":{"new":"Unauthenticated HTTP Data Exposure in Oracle Helidon Web Server","old":null},"type":"title"}],"id":"b164e6a8-d4c9-4b68-a9cf-cda6b29f4c04"},{"created":"2026-08-28T19:45:00+00:00","data":[{"details":{"new":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).  Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","old":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).   The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)."},"type":"description"},{"details":{"added":["cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"}],"id":"75f55d7d-493c-44d4-a8f1-36c23141224e"},{"created":"2026-08-28T22:15:00+00:00","data":[{"details":{"new":null,"old":"Unauthenticated HTTP Data Exposure in Oracle Helidon Web Server"},"type":"title"}],"id":"5c8d4e56-a76f-4f3a-a68f-e9ba18669fd5"}],"cpes":{"data":["cpe:2.3:a:oracle:helidon:*:*:*:*:*:*:*:*","cpe:2.3:a:oracle:helidon:4.5.0:*:*:*:*:*:*:*"],"providers":["mitre","nvd"]},"created":{"data":"2026-08-18T21:03:58.387000+00:00","provider":"mitre"},"description":{"data":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).  Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00437},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://www.oracle.com/security-alerts/cspuaug2026.html"],"providers":["mitre","nvd"]},"title":{"data":null,"provider":null},"updated":{"data":"2026-08-28T22:00:15.314292+00:00","provider":"enrichment"},"vendors":{"data":["oracle","oracle$PRODUCT$helidon"],"providers":["mitre","nvd","enrichment"]},"weaknesses":{"data":["CWE-200"],"providers":["nvd","vulnrichment"]}},"vulnrichment":{"cpes":[],"created":"2026-08-18T21:03:58.387000+00:00","description":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).   The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":null,"updated":"2026-08-25T01:38:26.118000+00:00","vendors":[],"vulnrichment_repo_path":"2026/73xxx/CVE-2026-73884.json","weaknesses":["CWE-200"]}}