This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to compromise Helidon and read some accessible data without authorization. The CVSS 3.1 base score is 3.7, reflecting a low-severity confidentiality impact with no impact on integrity or availability. The affected versions are 3.0.0 through 3.2.19 inclusive, and version 3.2.20. No known exploits are reported in the wild. Oracle's advisory references this vulnerability as part of their August 2026 Critical Security Patch Update, which includes many patches across products. Customers are strongly advised to apply available patches promptly.

Successful exploitation results in unauthorized read access to a subset of Helidon accessible data, impacting confidentiality. There is no impact on data integrity or system availability. The vulnerability requires network access via HTTP and is difficult to exploit. No known active exploitation has been reported.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers should apply these patches promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official patches.