This vulnerability affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized read and write access to some Helidon accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability. The vendor advisory does not explicitly confirm patch availability for this specific CVE but includes Helidon 4.5.0 in a list of affected versions for which patches exist in the August 2026 Critical Security Patch Update. Oracle recommends applying available patches without delay.

Successful exploitation allows unauthorized reading and modification (update, insert, delete) of some data accessible via Helidon 4.5.0 without authentication. This compromises confidentiality and integrity of affected data but does not impact availability. The vulnerability is exploitable remotely over HTTP with low complexity and no privileges required.

Oracle's August 2026 Critical Security Patch Update advisory includes Helidon 4.5.0 among affected versions and strongly recommends applying security patches promptly. Although no explicit patch link for CVE-2026-73868 is provided, customers should apply the August 2026 Critical Security Patch Update to remediate this vulnerability. Staying on actively supported versions and timely patching is the recommended mitigation.