This vulnerability in Oracle Helidon (Imperative Web Server component) allows an unauthenticated attacker with network access via HTTP to compromise the system by gaining unauthorized read and write access to some accessible data. The affected versions are 3.0.0 through 3.2.17 and 3.2.18. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes patches for Helidon versions up to 3.2.19.

Successful exploitation allows unauthorized update, insert, or delete operations on some Helidon accessible data and unauthorized read access to a subset of that data. This compromises confidentiality and integrity of the affected data but does not affect system availability. The vulnerability is exploitable remotely without authentication.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to affected Helidon versions (3.0.0 through 3.2.19) to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated by the vendor advisory.