This vulnerability affects the Helidon component of Oracle Fusion Middleware (Imperative Web Server) in versions 3.0.0 through 3.2.17 and 3.2.18. It allows an unauthenticated attacker with network access via HTTP to compromise Helidon, potentially resulting in unauthorized access to critical or all Helidon accessible data. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.8 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N). The scope of impact extends beyond Helidon to additional Oracle products. Oracle’s August 2026 Critical Security Patch Update advisory references this vulnerability and recommends applying patches promptly. However, no direct patch links for this specific CVE were provided in the input data.

An unauthenticated attacker with network access via HTTP could exploit this vulnerability to gain unauthorized access to critical or all data accessible through Helidon. The confidentiality impact is high, but there is no impact on integrity or availability. The vulnerability’s exploitation is difficult, and it may also affect other Oracle products due to scope change.

Oracle’s August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 security patches across multiple products. Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay to mitigate this vulnerability. Since the advisory is the authoritative source and no specific patch link was provided, users should consult the Oracle Critical Security Patch Update documentation for Helidon versions 3.0.0 through 3.2.19 and later to obtain and apply the relevant patches. No indication was given that no action is required or that the vulnerability is already mitigated.