CVE-2026-73928 Oracle CVE debrief

Who should care

Users of Helidon version 4.5.3, administrators of Oracle Fusion Middleware, and security teams responsible for vulnerability management and patching should prioritize patching due to high CVSS score of 7.2 and potential scope change impacting additional products. They should review system inventories for affected Helidon deployments and assess potential impact on their environments.

Technical summary

The CVE-2026-73928 vulnerability is in the Imperative Web Server component of Helidon, a product of Oracle Fusion Middleware. The supported version that is affected is 4.5.3. This easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. The CVSS 3.1 Base Score is 7.2 (Confidentiality and Integrity impacts). The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Defensive priority

Helidon users should prioritize patching due to high CVSS score of 7.2 and potential scope change impacting additional products.

Recommended defensive actions

• Apply patches or updates provided by Oracle to address the vulnerability
• Implement compensating controls such as network segmentation or access restrictions
• Monitor systems for suspicious activity
• Inventory checks for affected Helidon version 4.5.3
• Exception tracking for potential scope change impacts

Evidence notes

The CVE-2026-73928 vulnerability affects Helidon version 4.5.3 and allows unauthenticated attackers with network access via HTTP to compromise Helidon, potentially impacting additional products. Successful attacks can result in unauthorized update, insert or delete access to some Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data.

Official resources