This vulnerability in Oracle Helidon (Imperative Web Server component) affects versions 3.0.0 through 3.2.19. An unauthenticated attacker with network access via HTTP can exploit this flaw, but successful exploitation requires user interaction from a third party. The attack scope includes unauthorized read and modification (update, insert, delete) of accessible data within Helidon. The vulnerability has a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and limited confidentiality and integrity impact.

Exploitation can result in unauthorized disclosure and modification of data accessible through Helidon. The vulnerability does not impact availability. The scope change indicates that other products relying on Helidon may also be affected. No known exploits are reported in the wild at this time.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Users should apply the official patches promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are specified beyond patching.