This vulnerability affects Oracle Helidon 3.2.18 in the Imperative Web Server component. It allows a low privileged attacker with network access via HTTP to compromise Helidon, resulting in unauthorized access and modification of data. The vulnerability has a CVSS 3.1 score of 8.5 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. The vulnerability's exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. Oracle's August 2026 Critical Security Patch Update addresses this vulnerability among others, with patches available for Helidon versions including 3.2.18.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible via Helidon. Additionally, attackers may gain unauthorized ability to update, insert, or delete some Helidon accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products relying on Helidon may also be impacted.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users of Helidon version 3.2.18 should apply the official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.