This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is exploitable remotely over HTTP by an attacker with low privileges, enabling unauthorized access to critical data or complete access to all data accessible via Helidon. Additionally, the attacker may gain unauthorized update, insert, or delete capabilities on some data. The CVSS 3.1 base score is 8.5, reflecting high confidentiality and integrity impacts with no availability impact. The vulnerability affects Helidon versions >=3.0.0 <=3.2.17 and =3.2.18. Oracle has published a Critical Security Patch Update including fixes for this vulnerability.

Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible through Helidon, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the affected systems. There is no reported impact on availability. The vulnerability may also affect additional Oracle products that rely on Helidon, expanding the scope of impact.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to remediate the issue. Oracle strongly recommends running actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.