Threat Intelligence Report — CVE-2026-83460

Executive Summary

CVE-2026-83460 is an unauthenticated access-control vulnerability in the Oracle Helidon product of Oracle Fusion Middleware, specifically in the LRA (Long Running Actions) component. Helidon versions 4.0.0 through 4.5.4 are affected. An unauthenticated attacker with network access over HTTP can trigger unauthorized read access to a subset of Helidon-accessible data and unauthorized update, insert, or delete operations against a subset of that data, resulting in a CVSS 3.1 Base Score of 6.5 (Medium) driven by Low Confidentiality and Low Integrity impact.

Technical Analysis

Helidon is Oracle's open-source set of Java libraries for writing microservices, with two principal programming models: Helidon SE and Helidon MP (MicroProfile). The vulnerability resides in the LRA component — the Long Running Actions implementation that coordinates distributed transactions and saga-style workflows across microservices. LRA exposes a coordination service and participant endpoints that must be reachable by participating services over HTTP to coordinate action lifecycle events.

The NVD description states plainly that the issue is "Easily exploitable" by an unauthenticated attacker with network access via HTTP. This indicates that at least one LRA-exposed HTTP surface lacks an authentication or authorization control that the design assumes to be present, allowing a remote actor to invoke data-modifying operations (update/insert/delete) against a subset of reachable data and to read a subset of that data. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N confirms:

• AV:N — exploitable over the network.
• AC:L — no special conditions or race windows required.
• PR:N — no credentials or prior authentication are required.
• UI:N — no user interaction.
• S:U — impact is scoped to the vulnerable Helidon component.
• C:L / I:L — limited confidentiality and integrity impact; A:N — no availability impact.

The low integrity and confidentiality values, combined with the absence of availability impact, suggest that the exposed operations affect only a bounded subset of data associated with LRA coordination state and lifecycle actions, not the entire host or database.

Important limitation: The NVD description and CNA title do not disclose specific function names, class names, URL endpoints, or API parameter names. This report therefore describes the vulnerability at the access-control class level and does not fabricate implementation details. No public proof-of-concept, Nuclei template, or exploit code is currently available.

Additional note: CWE is listed as N/A in the source data. The closest applicable class based on the described impact — unauthenticated modification of data — is CWE-284 (Improper Access Control), but this should be treated as an analytical inference, not a vendor-confirmed mapping.

Exploitation Scenarios

Because no public PoC exists, the attack chain below is inferred from the vulnerability class (unauthenticated HTTP access to an LRA endpoint) and is described only at that level. No endpoint names or parameters are invented.

1. Reconnaissance / target identification. An attacker identifies internet- or intranet-exposed Helidon services running in the affected range. LRA coordination endpoints and participant callbacks are typically reachable over HTTP on the service's listening port (commonly container/microservice ports such as 8080). Fingerprinting may leverage Helidon's default HTTP server headers and characteristic response behavior. Shodan/Censys-style scanning for Helidon banners and LRA-related paths is the likely enumeration method.

2. Triggering the flaw. The attacker sends crafted, unauthenticated HTTP requests directly to the vulnerable LRA-facing surface. Because the vulnerability permits network-level trigger with no privileges (PR:N), no login flow or token is required. The precise request method, path, and payload cannot be stated from available data and are not fabricated here.

3. Payload / execution method. At the class level, this is an access-control bypass: the attacker invokes LRA lifecycle/data operations that should have required authorization. The request performs update/insert/delete and read operations against the subset of data the unauthenticated endpoint can reach.

4. Post-exploitation impact. Successful exploitation yields unauthorized modification (update/insert/delete) and limited read access to Helidon-accessible data. Given A:N, the attacker cannot directly cause denial of service via this vector. The most likely real-world consequences are corruption or manipulation of workflow/coordination state and disclosure of a subset of coordinated data, which may be leveraged for follow-on abuse (e.g., tampering with saga steps or injecting fraudulent state into a distributed transaction).

Impact Assessment

• Business impact: Integrity impact to LRA/coordination data can corrupt distributed workflows, potentially causing downstream business-logic errors, fraudulent state transitions, or data inconsistency across microservices. Confidentiality impact permits limited disclosure of coordinated data, which may include business-sensitive identifiers or records reachable by the LRA component.
• Affected systems: Any Helidon deployment in the 4.0.0–4.5.4 range with LRA enabled and reachable over the network. Microservice platforms that rely on LRA for sagas/distributed transactions are at highest operational risk.
• Blast radius: Scoped (S:U) to the Helidon component, with Low integrity and Low confidentiality, no availability impact — but in a microservice mesh the coordination layer is high-leverage, so secondary effects may exceed the direct CVSS impact.
• Severity context: CVSS 6.5 Medium. EPSS 0.00281 (≈20.7th percentile) indicates low current exploit likelihood in the wild. Not in CISA KEV. No public exploit, no Nuclei template, no exploit code observed.

Detection Guidance

Detection here is challenging because the vulnerable request may resemble legitimate LRA coordination traffic. Rules below focus on anomalous unauthenticated access patterns to exposed Helidon/LRA services and on integrity anomalies; they are generic adaptations and should be tuned to the environment.

Sigma Rule

title: Potential Helidon LRA Unauthenticated Access Attempts (CVE-2026-83460)
id: 6b1f7c2a-0d4e-4a7b-9c3e-helidonlra01
status: experimental
description: Detects repeated unauthenticated HTTP requests to Helidon LRA-related endpoints, consistent with access-control bypass attempts against CVE-2026-83460.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-83460
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
logsource:
  category: webserver
  product: helidon
detection:
  selection_method:
    cs-method:
      - 'PUT'
      - 'POST'
      - 'DELETE'
      - 'PATCH'
  selection_lra:
    cs-uri-stem|contains:
      - '/lra'
      - '/lra-coordinator'
      - '/LRA'
  selection_unauthed:
    sc-status:
      - 200
      - 201
      - 204
  filter_internal:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.'
  condition: selection_method and selection_lra and selection_unauthed and not filter_internal
falsepositives:
  - Legitimate intra-mesh LRA coordination traffic
  - Authorized administrative tooling
level: medium

YARA Rule

rule CVE_2026_83460_Helidon_LRA_Exploit_Artifacts
{
    meta:
        author = "valtersit.com"
        description = "Detects strings associated with Helidon LRA access-control bypass probing (CVE-2026-83460)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-83460"
        date = "2026-01-01"
        tlp = "WHITE"

    strings:
        $lra1 = "/lra-coordinator" ascii nocase
        $lra2 = "/lra/" ascii nocase
        $lra3 = "Long-Running-Action" ascii nocase
        $hel1 = "Helidon" ascii nocase
        $hdr1 = "Link: <" ascii nocase
        $hdr2 = "Rel=\"lra" ascii nocase

    condition:
        uint16(0) == 0x4854 or
        (2 of ($lra*) and 1 of ($hel1, $hdr*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-83460 Helidon LRA Unauthenticated Access Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/lra"; nocase; http.header; content:"Long-Running-Action"; nocase; threshold: type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-83460; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-83460; sid:2026834601; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where http.request.method in ("POST", "PUT", "DELETE", "PATCH")
    and url.path like "/lra*" ]
  [ network where http.response.status_code in (200, 201, 204)
    and url.path like "/lra*" ]

Splunk SPL Query

index=web sourcetype=helidon OR sourcetype=access_combined
| search uri_path IN ("/lra*", "/lra-coordinator*")
| eval is_write=if(http_method IN ("POST","PUT","DELETE","PATCH"),1,0)
| where is_write=1 AND status IN ("200","201","204")
| stats count dc(uri_path) as paths values(src_ip) as sources by src_ip
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,helidon,cve-2026-83460,">
  <rule id="20268346" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>/lra</match>
    <regex>\"(POST|PUT|DELETE|PATCH)\s+/lra</regex>
    <description>CVE-2026-83460: Possible unauthenticated Helidon LRA access attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="20268347" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <match>/lra-coordinator</match>
    <description>CVE-2026-83460: LRA coordinator access - monitor for anomalous origin</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or advisory is available as of this report. The following are general hardening measures for an unauthenticated access-control defect in a network-exposed microservice component.

1. Immediate mitigations

• Restrict network exposure of Helidon services and, in particular, any LRA coordinator/participant endpoints. Do not expose LRA surfaces to untrusted networks.
• Place affected services behind an authenticating reverse proxy or API gateway that enforces authorization on all LRA-related HTTP paths.
• Apply network segmentation and allow-list egress/ingress so only trusted participating services can reach LRA coordination endpoints.
• Disable LRA if the application does not require distributed long-running action coordination.
• Add rate limiting and monitoring on LRA paths to detect probing (see Detection Guidance).

2. Patch / upgrade steps

• Track the Oracle Fusion Middleware / Helidon security advisories and Oracle Critical Patch Update (CPU) cycle for a fix covering 4.0.0–4.5.4.
• Because patch confidence is 0/4, no upgrade target can be confirmed. When a fixed version is published, upgrade Helidon and re-validate LRA configuration.
• Monitor the NVD entry and Oracle security pages for authoritative update guidance.

3. Long-term hardening

• Enforce authentication and authorization by default on all microservice management/coordination endpoints; never rely on network isolation alone.
• Adopt defense-in-depth: mTLS between services, zero-trust ingress, and least-privilege data access for coordination components.
• Maintain an SBOM and vulnerability monitoring for Helidon and Java microservice dependencies to shorten exposure windows for future CVEs.
• Continuously scan exposed services (Shodan/internal ASM) for Helidon banners and unauthenticated LRA surfaces.

References

1. NVD — CVE-2026-83460: https://nvd.nist.gov/vuln/detail/CVE-2026-83460
2. Oracle Security Alerts / Critical Patch Updates: https://www.oracle.com/security-alerts/
3. Helidon Project (Oracle) — official project and security documentation: https://helidon.io/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-83460 not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. EPSS score source (0.00281, ≈20.7th percentile): https://www.first.org/epss/

Threat actor / exploit-in-the-wild status: No known threat actor campaigns, public PoC, Nuclei template, or exploit code were identified for CVE-2026-83460 at the time of writing. EPSS is low (0.00281), reinforcing that exploitation activity is currently unlikely. This assessment should be revisited if a public exploit or KEV listing emerges.