This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is easily exploitable remotely without authentication via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, unauthorized access to all Helidon accessible data, and the ability to cause a partial denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact with low availability impact. The affected versions are 3.0.0 through 3.2.17 inclusive, and 3.2.18.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to critical data, modify or delete data, and cause partial denial of service conditions in Helidon. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches without delay and remain on actively supported versions. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified.