This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is exploitable by an attacker who already has high privileges and logon access to the infrastructure where Helidon runs. Exploitation can result in unauthorized access to critical or all data accessible by Helidon. The CVSS 3.1 vector is AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. Affected versions are 4.0.0 through 4.5.1 inclusive.

An attacker with high privileges and logon access to the Helidon infrastructure can exploit this vulnerability to gain unauthorized access to critical or all data accessible by Helidon. There is no reported impact on integrity or availability. The vulnerability is rated medium severity with a CVSS score of 4.4, primarily affecting confidentiality.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. Customers are strongly recommended to apply the relevant security patches promptly. The advisory lists affected Helidon versions up to 4.5.2, indicating that patches are available for affected versions. Organizations should upgrade to fixed versions beyond 4.5.1 where possible. No indication from the vendor advisory suggests that no action is required or that the issue is already mitigated without patching.