This vulnerability affects the Imperative Web Server component of Oracle Helidon. It allows an attacker with low privileges and network access over HTTP to compromise the system by gaining unauthorized read and write access to certain data accessible through Helidon. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality and integrity. The affected versions explicitly include >=4.0.0 <=4.4.1 and =4.5.0. Oracle's August 2026 Critical Security Patch Update addresses this and many other vulnerabilities across multiple products, including Helidon.

Successful exploitation can lead to unauthorized reading, updating, inserting, or deleting of some data accessible via Helidon, compromising confidentiality and integrity of that data. There is no impact on availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit if the attacker has such access.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to remediate this issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated by the vendor advisory.