This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise Helidon, resulting in unauthorized access to critical data or complete access to all Helidon accessible data, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The affected versions are 3.0.0 through 3.2.17 inclusive and 3.2.18. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability for this specific CVE in the provided content.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Helidon, as well as unauthorized modification (update, insert, delete) of some data. This compromises confidentiality and integrity of the data handled by Helidon. There is no impact on availability. The vulnerability requires network access via HTTP but is difficult to exploit.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory includes this vulnerability among many others, implying that patches are available as part of this update. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions. No vendor advisory states that no action is required or that the issue is already mitigated, so patching is advised.