CVE-2026-73869 is a vulnerability in the Imperative Web Server component of Oracle Helidon (versions 3.0.0 to 3.2.17 and 3.2.18). It allows an unauthenticated attacker with network access via HTTP to compromise Helidon by leveraging a flaw that requires user interaction from a third party. The vulnerability can result in unauthorized read and write (update, insert, delete) access to Helidon accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and low confidentiality and integrity impacts without availability impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not provide explicit patch links or confirm patch status for Helidon versions affected.

Successful exploitation allows unauthorized read and modification (update, insert, delete) of some data accessible via Helidon, potentially compromising confidentiality and integrity of that data. The vulnerability requires user interaction from a person other than the attacker and affects the security scope beyond Helidon to additional products. The CVSS score of 6.1 indicates a medium severity impact focused on confidentiality and integrity, with no availability impact.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability in its list of addressed issues. However, explicit patch availability for Helidon versions 3.0.0 to 3.2.18 is not confirmed in the provided advisory content. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Oracle strongly recommends applying available security patches promptly and remaining on actively supported versions. Until patch confirmation, monitor Oracle advisories for updates. No vendor statement indicates that no action is required or that the issue is already mitigated.