This vulnerability affects Oracle Helidon 4.5.1, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized operations on accessible data, including reading, updating, inserting, or deleting data. The vulnerability has a CVSS 3.1 score of 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, scope change, low confidentiality and integrity impact, and no availability impact. The vulnerability may also impact other Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 4.5.1 among affected versions but does not explicitly confirm patch availability or remediation status for this version in the provided content.

Successful exploitation can result in unauthorized read access to some Helidon accessible data and unauthorized update, insert, or delete access to some of that data. The vulnerability impacts confidentiality and integrity but does not affect availability. The scope change indicates that other Oracle products relying on Helidon may also be impacted.

Oracle has released a Critical Security Patch Update in August 2026 that addresses vulnerabilities in Helidon and other products. Customers are strongly recommended to apply the available security patches promptly and remain on actively supported versions. Patch status for Helidon 4.5.1 is not explicitly confirmed in the advisory content provided; therefore, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. No vendor advisory states that no action is required or that the vulnerability is already mitigated without patching.