This vulnerability affects Oracle Helidon 4.5.0 and allows an unauthenticated attacker with network access via HTTP to compromise the product by gaining unauthorized read access to a subset of accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates that the attack requires no privileges or user interaction and has low complexity, impacting confidentiality only. The vulnerability is in the Imperative Web Server component of Oracle Fusion Middleware Helidon. Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 4.5.0 among affected products but does not explicitly state that a patch for this vulnerability is available or that it has been mitigated.

Successful exploitation results in unauthorized read access to some Helidon accessible data, potentially exposing sensitive information. There is no impact on data integrity or availability. The vulnerability can be exploited remotely without authentication, increasing the risk of exposure if the affected version is deployed in accessible network environments.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Until an official patch or workaround is confirmed, restrict network access to Helidon 4.5.0 instances where possible to reduce exposure.