This vulnerability in Oracle Helidon (Imperative Web Server component) affects versions 3.0.0 through 3.2.17 and 3.2.18. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized update, insert, or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of that data. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N with a base score of 4.2, reflecting limited confidentiality and integrity impacts and no availability impact. The vulnerability is considered difficult to exploit.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible via Helidon. The impact is limited to confidentiality and integrity with no availability impact. The vulnerability requires network access and low privileges but has a high attack complexity, reducing the likelihood of exploitation.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected Helidon versions 3.0.0 through 3.2.19 and 4.0.0 through 4.5.2 as per the Oracle advisory. Staying on actively supported versions and applying security patches without delay is recommended. Patch availability details are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.