This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is exploitable remotely without authentication over HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Helidon, unauthorized access to critical or all accessible data, and the ability to cause a partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts with low availability impact. The affected versions are 4.0.0 through 4.4.1 inclusive and 4.5.0. Oracle has published a Critical Security Patch Update advisory for August 2026 that includes fixes for this and other vulnerabilities. Customers are strongly advised to apply available patches promptly.

The vulnerability allows unauthenticated remote attackers to fully compromise the confidentiality and integrity of data accessible via Helidon, including unauthorized creation, deletion, or modification of critical data. Additionally, attackers can cause a partial denial of service to the Helidon service, impacting availability. The CVSS score of 9.4 reflects critical impact on confidentiality and integrity and a lower but significant impact on availability.

Oracle has released security patches for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers should apply the relevant patches for Helidon versions 4.0.0 through 4.5.2 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this vulnerability. No alternative mitigations or workarounds are specified in the advisory.