CVE-2026-73930 is a critical security vulnerability in Oracle Helidon 4.5.3, specifically in the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to compromise Helidon, potentially resulting in unauthorized creation, deletion, or modification of critical or all accessible data, unauthorized read access to some data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 9.9 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, and high impact on integrity with some confidentiality and availability impact. The vulnerability may also impact other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among 943 patches but does not explicitly confirm patch availability or remediation level for Helidon 4.5.3 in the provided content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Helidon, unauthorized read access to a subset of Helidon data, and partial denial of service. The vulnerability affects confidentiality, integrity, and availability, with a critical CVSS score of 9.9. The scope of impact may extend beyond Helidon to additional Oracle products.

Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory references this vulnerability as part of a large set of patches. However, the provided advisory content does not explicitly confirm patch availability or remediation status for Helidon 4.5.3. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance.