CVE-2026-73920 affects Oracle Helidon version 4.5.0, specifically the Imperative Web Server component. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access over HTTP to compromise the product. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data, unauthorized access to critical or all data, and partial denial of service conditions. The vulnerability has a CVSS 3.1 score of 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact with low availability impact. Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 4.5.0 among affected products but does not explicitly confirm patch availability for this version in the provided content.

The vulnerability allows an unauthenticated remote attacker to fully compromise Oracle Helidon 4.5.0 via HTTP. This includes unauthorized creation, deletion, or modification of critical or all accessible data, unauthorized access to sensitive data, and the ability to cause a partial denial of service. The impact affects confidentiality, integrity, and availability, with confidentiality and integrity impacts rated high and availability impact rated low according to CVSS 3.1 metrics.

Oracle has released a Critical Security Patch Update advisory covering this vulnerability among others. Customers should review the advisory at https://www.oracle.com/security-alerts/cspuaug2026.html and apply the relevant patches promptly. The advisory strongly recommends staying on actively supported versions and applying security patches without delay. Patch status for Helidon 4.5.0 is not explicitly confirmed in the provided advisory content; therefore, customers should verify patch availability and remediation instructions directly from Oracle's advisory and support channels.