CVE-2026-73925 affects Oracle Helidon version 1.4.19, specifically the Imperative Web Server component. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access over HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data, and unauthorized read access to a subset of data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with low confidentiality impact but high integrity impact and no availability impact. Oracle’s August 2026 Critical Security Patch Update includes patches for this vulnerability among 943 fixes across multiple products. The vendor strongly recommends applying patches without delay to mitigate this and other vulnerabilities.

The vulnerability allows an unauthenticated remote attacker to gain unauthorized access to Helidon data via HTTP, enabling creation, deletion, or modification of critical or all accessible data, and unauthorized reading of some data. This compromises data integrity and confidentiality but does not affect availability. The CVSS score of 8.2 indicates a high severity impact. No known exploits in the wild have been reported at this time.

Oracle has released security patches for Helidon including version 1.4.19 as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. The vendor advisory does not indicate that no action is required or that the issue is already mitigated without patching. Therefore, applying the official patches is the recommended mitigation.