This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Helidon. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impacts. The affected versions are from 3.0.0 up to and including 3.2.17, plus 3.2.18. Oracle has included fixes for this vulnerability in their August 2026 Critical Security Patch Update.

Successful exploitation allows an unauthenticated remote attacker to fully compromise the confidentiality and integrity of data accessible via Helidon. This includes unauthorized creation, deletion, or modification of critical data or complete access to all Helidon accessible data. There is no impact on availability. The vulnerability is rated critical with a CVSS score of 9.1.

Oracle has released security patches for this vulnerability in the August 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patches.