CVE-2026-73904 affects Oracle Helidon 4.5.1, specifically the Imperative Web Server component. It is an easily exploitable vulnerability that permits unauthenticated attackers with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized update, insert, or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of that data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts. Oracle's August 2026 Critical Security Patch Update advisory includes Helidon among many other products receiving security patches, emphasizing the importance of applying these updates promptly. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-73904, so users should verify patch availability through the provided vendor links.

The vulnerability allows an unauthenticated remote attacker to gain unauthorized read and write access to certain data accessible via Helidon 4.5.1. This compromises confidentiality and integrity of the data but does not affect availability. There are no known exploits in the wild at this time. The impact is limited to the affected version and component as described.

Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. The August 2026 Critical Security Patch Update advisory includes patches for Helidon and other products. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Patch status for CVE-2026-73904 is not explicitly confirmed in the advisory, so users must verify current remediation guidance from Oracle. No vendor statement indicates that no action is required or that the vulnerability is already mitigated without patching.