CVE-2026-71152

Helidon 4.5.0's Imperative Web Server component has a critical CVSS 9.8 flaw allowing unauthenticated remote attackers to fully compromise the server via HTTP. No root cause, exploit code, or patch details are provided; monitoring Oracle's August 2026 security advisory is advised.