CVE-2026-73931 is a vulnerability in Oracle Helidon (Imperative Web Server component) affecting versions 4.0.0 to 4.5.2 and 4.5.3. The flaw allows an unauthenticated attacker with network access via HTTP to perform unauthorized data operations including update, insert, delete, and read on Helidon-accessible data, as well as cause a partial denial of service. The vulnerability has a CVSS 3.1 score of 8.3 with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change affecting confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches across multiple products. The advisory emphasizes the importance of applying patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized modification and disclosure of data accessible via Helidon, and partial denial of service. The vulnerability affects confidentiality, integrity, and availability, potentially impacting additional Oracle products beyond Helidon due to scope change. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the official patches promptly to remediate the issue. Oracle recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.