CVE-2026-83439

CVE-2026-83439 is a high-severity (CVSS 8.1) vulnerability in the helidon-security-providers-idcs-mapper component of Oracle Helidon, the Java microservices framework within Oracle Fusion Middleware that maps Oracle Identity Cloud Service (IDCS) identities and roles into application security context. A low-privileged (authenticated) remote attacker exploiting this flaw over HTTP can escalate to gain unauthorized creation, deletion, or modification of critical Helidon-accessible data, as well as unauthorized read access to critical or all Helidon-accessible data. The vulnerability is rated easily exploitable but requires valid low-privilege credentials, and has no availability impact. Affected deployments are Helidon 3.0.0-3.2.20 and 4.0.0-4.5.4 that use the IDCS mapper security provider. There is no known public proof-of-concept, the issue is not on the CISA KEV list, and no in-the-wild exploitation has been reported.

What to do: Upgrade Helidon 3.x deployments from 3.2.20 or earlier and 4.x deployments from 4.5.4 or earlier to the first patched release Oracle ships in its Critical Patch Update, following the CPU advisory for this CVE. Audit IDCS-mapper-based authentication logs for low-privilege accounts that accessed or modified data beyond their assigned roles, and restrict network exposure of Helidon services to trusted clients until patched. If upgrading is delayed, review and tighten IDCS role/group mapping scopes and enforce least-privilege authorization at the gateway.