Threat Intelligence Database

A vulnerability in the Helidon component of Oracle Fusion Middleware (versions 4.0.0 through 4.5.4) allows an unauthenticated attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with impacts on confidentiality and integrity but no impact on availability. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSON). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

A vulnerability in Oracle Fusion Middleware's Helidon WebSocket component (CVE-2026-83330) affects versions 4.0.0 through 4.5.4. It allows an unauthenticated attacker with network access via HTTP to cause a denial of service by hanging or crashing the Helidon service. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity due to availability impact. Oracle has released security patches addressing this issue in their September 2026 Critical Security Patch Update.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

A vulnerability in the Helidon webserver component of Oracle Fusion Middleware affects versions 4.0.0 through 4.5.4. This flaw allows an unauthenticated attacker with network access via TCP to cause a denial of service by hanging or crashing the Helidon service. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a high severity impact on availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected versions.

CVE-2026-73939 is a high-severity vulnerability in Oracle Helidon versions 3.0.0 through 3.2.19 and 3.2.20. It allows an unauthenticated attacker with network access via HTTP to compromise Helidon, potentially leading to unauthorized creation, deletion, or modification of critical or all accessible data. The vulnerability impacts integrity but not confidentiality or availability. Oracle has published an advisory including this vulnerability in its August 2026 Critical Security Patch Update.

CVE-2026-73938 is a vulnerability in Oracle Helidon versions 4.0.0 through 4.4.1 and version 4.5.0 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a high severity with a significant confidentiality impact but no impact on integrity or availability. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory, which provides patches for affected versions.

CVE-2026-73937 is a vulnerability in Oracle Helidon versions 4.0.0 through 4.4.1 and version 4.5.0. It allows an unauthenticated attacker with network access via HTTP/2 to cause a denial of service by hanging or crashing Helidon and to gain unauthorized read access to some data accessible by Helidon. The vulnerability has a high severity with a CVSS score of 8.2, impacting confidentiality and availability.