This vulnerability affects the Helidon component of Oracle Fusion Middleware, specifically the Imperative Web Server. It permits an unauthenticated attacker with network access via HTTP to compromise Helidon, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all Helidon-accessible data. The CVSS 3.1 base score is 7.4, reflecting high confidentiality and integrity impacts with no availability impact. The attack complexity is high, and no privileges or user interaction are required. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes patches for Helidon versions 3.0.0-3.2.19, 4.0.0-4.5.2, and others.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible through Helidon. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is difficult to exploit but does not require authentication or user interaction.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to affected Helidon versions. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the vendor advisory.