This vulnerability affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. It is easily exploitable remotely without authentication, allowing attackers to gain unauthorized access and perform critical data operations including creation, deletion, and modification. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. The vendor advisory lists Helidon 4.5.0 among affected versions but does not explicitly state patch availability or remediation status for this vulnerability. Oracle strongly recommends applying security patches promptly to mitigate risks.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Helidon 4.5.0. It also allows unauthorized access to critical or all accessible data, severely compromising confidentiality and integrity. There is no impact on availability reported. The vulnerability is remotely exploitable without authentication, increasing the risk of widespread compromise if unpatched.

Oracle's advisory strongly recommends that customers remain on actively supported versions and apply security patches without delay. However, the provided data does not confirm the availability of a specific patch or fix for Helidon 4.5.0 related to this vulnerability. Users should consult the Oracle Critical Security Patch Update advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch information and apply any relevant updates as soon as they become available. Until a patch is confirmed, restrict network access to Helidon services where possible.