This vulnerability in Oracle Helidon (Imperative Web Server component) enables an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Helidon, as well as unauthorized modification capabilities including update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact. Affected versions are 3.0.0 through 3.2.17 and 3.2.18. Oracle has published a Critical Security Patch Update advisory for August 2026 covering this and many other vulnerabilities, recommending patch application without delay.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to critical data or complete access to all data accessible by Helidon. Additionally, the attacker can perform unauthorized data modifications such as updates, inserts, or deletions on some of the accessible data. This compromises confidentiality and integrity of the affected system's data.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly to affected Helidon versions 3.0.0 through 3.2.19 and later. Remaining on actively supported versions and applying security patches without delay is the recommended mitigation. No alternative or temporary mitigations are specified in the advisory.