Oracle Helidon Flaw CVE-2026-101590 Rated Critical for Unauthenticated Remote Attacks
A critical vulnerability in Oracle Helidon allows unauthenticated attackers to fully compromise systems via HTTP without user interaction.
Key points
- CVE-2026-101590 is rated CVSS 9.1 Critical by the National Vulnerability Database.
- The flaw affects Oracle Helidon versions 4.0.0 through 4.5.5 in the microprofile-security component.
- Attackers can create, delete, or modify critical data without any authentication credentials.
The National Vulnerability Database lists CVE-2026-101590 as a critical security flaw in Oracle Fusion Middleware. This vulnerability resides within the Helidon product, specifically in the helidon-microprofile-security component. Security researchers have assigned it a CVSS 3.1 Base Score of 9.1, indicating severe risk. The entry highlights that the issue is easily exploitable by remote attackers.
According to the NVD record, the vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Helidon systems. The attack complexity is low, and no user interaction is required for exploitation. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data. Attackers may also gain complete access to all data accessible by the Helidon application.
Technical Severity and Impact
The CVSS vector for CVE-2026-101590 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This vector indicates a network-based attack vector with low complexity. The "PR:N" and "UI:N" fields confirm that no privileges and no user interaction are needed. The impact scores for Confidentiality and Integrity are both High, while Availability is Not Impacted. This means attackers can steal or alter data but not necessarily crash the service.
The description states that the flaw allows compromise of Helidon via HTTP. This network-accessible vector makes the vulnerability particularly dangerous for internet-facing deployments. The NVD notes that the weakness results in unauthorized access to critical data or all Helidon accessible data. This broad scope of potential data exposure underscores the critical rating assigned by the advisory body.
Affected Software Versions
The vulnerability affects supported versions of Oracle Helidon ranging from 4.0.0 to 4.5.5. Any deployment using these specific version numbers is considered affected by the NVD entry. The component identified as vulnerable is helidon-microprofile-security. Organizations running these versions should verify their current software state against this range. The advisory does not mention versions outside this 4.0.0 to 4.5.5 range as being affected.
There is no mention of a fix or patch in the provided source material. Consequently, no confirmed remediation exists in the public record referenced here. Users of Helidon 4.0.0 through 4.5.5 remain exposed until a vendor update is issued. The absence of a stated fix means the vulnerability remains active and exploitable in the wild.
What should you do?
Security teams should immediately audit their environments for any instances of Oracle Helidon. Specifically, check if the helidon-microprofile-security component is running versions 4.0.0 through 4.5.
What to do and how to stay safe
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
