CVE-2026-73930 is an easily exploitable vulnerability in Oracle Helidon's Imperative Web Server component that allows unauthenticated remote attackers to compromise the product via HTTP. Affected versions include 3.0.0 through 3.2.19, 4.0.0 through 4.5.2, and version 4.5.3. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all Helidon accessible data, unauthorized read access to some data, and partial denial of service. The vulnerability has a CVSS 3.1 score of 9.9 with network attack vector, low attack complexity, no privileges or user interaction required, and scope change. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others and urges customers to apply patches without delay.

The vulnerability allows unauthenticated attackers with network access to perform unauthorized creation, deletion, or modification of critical or all data accessible via Helidon, unauthorized read access to a subset of data, and cause partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. The scope change indicates that exploitation may affect additional products beyond Helidon.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability and recommends applying the provided security patches promptly. Customers should remain on actively supported versions and apply patches without delay. Patch status is implied to be available as part of the Critical Security Patch Update; consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.