This vulnerability in Helidon (Oracle Fusion Middleware) allows an unauthenticated remote attacker to exploit the Imperative Web Server component via HTTP, requiring user interaction from a third party. The attack can result in unauthorized read and modification (update, insert, delete) of accessible data within Helidon. The vulnerability affects Helidon versions 4.0.0 through 4.4.1 and 4.5.0. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts with no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes 943 security patches across multiple products including Helidon.

Exploitation of this vulnerability can lead to unauthorized read access and unauthorized update, insert, or delete operations on some data accessible through Helidon. The scope of impact extends beyond Helidon to additional products due to the nature of the vulnerability. The CVSS score of 6.1 indicates a medium severity impact primarily affecting confidentiality and integrity, with no impact on availability. The vulnerability requires user interaction from a person other than the attacker, which limits exploitation scenarios.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected Helidon versions. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.