This vulnerability affects the Imperative Web Server component of Oracle Helidon. It permits an unauthenticated attacker with network access over HTTP to compromise the system by gaining unauthorized update, insert, delete, and read access to certain Helidon accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity only. Affected versions explicitly include >=4.0.0 <=4.4.1 and =4.5.0. Oracle's August 2026 Critical Security Patch Update advisory lists Helidon among affected products and versions and provides patch availability documentation.

Successful exploitation allows unauthorized modification and disclosure of some Helidon accessible data, potentially compromising confidentiality and integrity. There is no impact on availability. The vulnerability is exploitable remotely without authentication, increasing risk. However, no known exploits in the wild have been reported to date.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.