This vulnerability affects the Imperative Web Server component of Oracle Helidon in versions 4.0.0 to 4.4.1 and 4.5.0. It permits a low privileged attacker who has logon access to the infrastructure hosting Helidon to compromise the application. The impact includes unauthorized access to critical or all Helidon-accessible data and unauthorized data modification capabilities. The CVSS vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

An attacker with low privileges and logon access to the Helidon infrastructure can gain unauthorized access to sensitive data or full data accessible by Helidon. They can also perform unauthorized updates, inserts, or deletions on some of the data. This compromises confidentiality and integrity of the data handled by Helidon but does not affect availability.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Staying on actively supported versions and timely patching is critical. No indication from the vendor advisory suggests that no action is required or that the issue is already mitigated without patching.