CVE-2026-71110 is a vulnerability in the Imperative Web Server component of Oracle Helidon, allowing a low privileged attacker with network access via HTTPS to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible via Helidon, as well as unauthorized access to such data. The vulnerability affects Helidon versions 1.0.0 through 1.4.18, 3.0.0 through 3.2.17, 4.0.0 through 4.4.1, and version 4.5.0 exactly. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N with a base score of 8.1. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes patches for affected Helidon versions.

The vulnerability allows an attacker with low privileges and network access via HTTPS to gain unauthorized capabilities to create, delete, or modify critical data or all data accessible through Helidon. It also allows unauthorized access to critical or all accessible data, impacting confidentiality and integrity. There is no reported impact on availability. This can lead to significant data compromise within affected Helidon deployments.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Affected users should apply the relevant patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.