CVE-2026-71065 is a vulnerability in Oracle Helidon (component: Imperative Web Server) affecting versions 3.0.0 through 3.2.17 and 3.2.18. It allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data and unauthorized data modification. The vulnerability has a CVSS 3.1 score of 9.3 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability may impact other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability and recommends applying patches promptly.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all data accessible through Helidon. The attacker can also perform unauthorized update, insert, or delete operations on some of the accessible data. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability's scope change means it may impact additional Oracle products beyond Helidon.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the available patches promptly to affected versions of Helidon (3.0.0 through 3.2.17 and 3.2.18). Oracle recommends remaining on actively supported versions and applying security patches without delay. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.