The Oracle MCP Server Helper Tool versions 1.0.1 to 1.0.156 contain a vulnerability that permits unauthenticated remote attackers to execute arbitrary SQL commands via network access over HTTP. This vulnerability is classified under CWE-89 (SQL Injection) and has a CVSS 3.1 base score of 8.7, indicating high severity. The vulnerability compromises confidentiality and integrity but does not impact availability. The vendor advisory does not provide explicit remediation or patch information but references a general Oracle security alerts page where no specific patch details are currently listed.

Successful exploitation of this vulnerability can lead to unauthorized execution of malicious SQL commands within the Oracle MCP Server Helper Tool environment. This can compromise the confidentiality and integrity of data managed by the tool. There is no indication that availability is affected. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html for current remediation guidance. Until an official fix is available, restrict network access to the Oracle MCP Server Helper Tool to trusted users only and monitor for unusual SQL activity. Do not assume the vulnerability is mitigated without vendor confirmation.