Remote Code Execution Vulnerability in Oracle Fusion Middleware's Helidon Product
CVE-2026-101575

6.5MEDIUM

Key Information:

Vendor

Oracle
Status
Helidon
Vendor
CVE Published:
20 October 2026

What is CVE-2026-101575?

A vulnerability exists in the Helidon component of Oracle Fusion Middleware that facilitates potential unauthorized access and manipulation of data. Unauthenticated attackers can exploit this vulnerability to connect via HTTP, allowing them to perform operations such as unauthorized data updates or deletions, unauthorized reads, and even induce a partial denial of service on Helidon. This vulnerability highlights the importance of safeguarding network access to vulnerable components, as attacks may impact broader systems integrally connected to Helidon.

Affected Version(s)

Helidon 4.0.0 <= 4.5.5

References

https://www.oracle.com/security-alerts/cpuoct2026.html
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.