This vulnerability affects Oracle Helidon version 4.5.0, specifically in the Imperative Web Server component. It allows an attacker with low privileges and network access over HTTPS to compromise the system, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is publicly known and published but no explicit patch or remediation level is stated in the input data. However, Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 4.5.0 among affected products and provides patch documentation for remediation.

Successful exploitation allows unauthorized creation, deletion, or modification of critical data or all data accessible via Helidon 4.5.0, compromising confidentiality and integrity. There is no impact on availability. The vulnerability enables a low privileged attacker with network access via HTTPS to gain significant unauthorized access to data.

Oracle has included Helidon 4.5.0 in its August 2026 Critical Security Patch Update advisory, which provides security patches addressing this vulnerability. Customers are strongly advised to apply the relevant patches from the August 2026 Critical Security Patch Update without delay. Patch status is not explicitly stated in the input data but the vendor advisory is the authoritative source for patch availability and installation instructions. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch information and remediation guidance.