CVE-2026-71152 is a critical security vulnerability in Oracle Helidon, specifically in the Imperative Web Server component. It affects Helidon versions >=3.0.0 <=3.2.17, >=4.0.0 <=4.4.1, and =4.5.0. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise the Helidon server, potentially resulting in full takeover. The CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating the vulnerability is remotely exploitable without privileges or user interaction and impacts confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability and includes it among 943 security patches across multiple products, including Helidon. Oracle strongly urges customers to remain on supported versions and apply patches without delay to mitigate exploitation risks.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via HTTP to fully compromise the Helidon server. This can lead to complete takeover, impacting confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects the critical severity and the potential for severe operational and security consequences.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches for Helidon versions 3.0.0 through 3.2.19, 4.0.0 through 4.5.2, and 4.5.0 as soon as possible. Oracle strongly recommends remaining on actively supported versions and applying patches promptly to prevent exploitation. No indication was given that the vulnerability is already mitigated or requires no action. Check Oracle's official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.