This vulnerability affects Oracle Helidon 3.2.18, specifically the Imperative Web Server component. It is easily exploitable remotely without authentication via HTTP, enabling attackers to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification of some data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with limited integrity impact and no availability impact. Oracle's August 2026 Critical Security Patch Update addresses this vulnerability among others.

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized access to critical data or all data accessible by Helidon, and can also perform unauthorized data modifications such as updates, inserts, or deletions on some data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users of Oracle Helidon 3.2.18 should apply the available security patches promptly to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified.