PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73928 Oracle CVE debrief

The CVE-2026-73928 vulnerability is in the Imperative Web Server component of Helidon, a product of Oracle Fusion Middleware. The supported version that is affected is 4.5.3. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. The CVSS 3.1 Base Score is 7.2 (Confidentiality and Integrity impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). Users should verify the affected version and consider patching due to high CVSS score and potential scope change.

Vendor
Oracle
Product
Helidon
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-21
Advisory published
2026-08-18
Advisory updated
2026-08-21

Who should care

Users of Helidon version 4.5.3, administrators of Oracle Fusion Middleware, and security teams responsible for vulnerability management and patching should prioritize patching due to high CVSS score of 7.2 and potential scope change impacting additional products. They should review system inventories for affected Helidon deployments and assess potential impact on their environments.

Technical summary

The CVE-2026-73928 vulnerability is in the Imperative Web Server component of Helidon, a product of Oracle Fusion Middleware. The supported version that is affected is 4.5.3. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. The CVSS 3.1 Base Score is 7.2 (Confidentiality and Integrity impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Defensive priority

Helidon users should prioritize patching due to high CVSS score of 7.2 and potential scope change impacting additional products.

Recommended defensive actions

  • Apply patches or updates provided by Oracle to address the vulnerability
  • Implement compensating controls such as network segmentation or access restrictions
  • Monitor systems for suspicious activity
  • Inventory checks for affected Helidon version 4.5.3
  • Exception tracking for potential scope change impacts

Evidence notes

The CVE-2026-73928 vulnerability affects Helidon version 4.5.3 and allows unauthenticated attackers with network access via HTTP to compromise Helidon, potentially impacting additional products. Successful attacks can result in unauthorized update, insert or delete access to some Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73928 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73928

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73928 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73928

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.