This vulnerability affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to read a subset of data accessible through Helidon without authorization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and a confidentiality impact only. The vulnerability is publicly documented as CVE-2026-73906 with a medium severity rating. Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 4.5.0 among affected versions but does not explicitly state the availability of a patch for this specific vulnerability in the provided content. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation results in unauthorized read access to a subset of data accessible by Helidon, impacting confidentiality. There is no impact on integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing risk if unpatched.

Oracle's advisory strongly recommends applying security patches promptly and remaining on actively supported versions. The advisory lists Helidon 4.5.0 as affected and provides links to patch availability documentation. However, the exact patch status for this vulnerability is not explicitly confirmed in the provided advisory content. Users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Until patched, restrict network access to Helidon HTTP interfaces where possible.