CVE-2026-73884

Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to access critical or all Helidon data via HTTP; no patch version or exploitation details are provided in the documents, so monitoring Oracle's August 2026 advisory is advised.