This vulnerability affects the Helidon component of Oracle Fusion Middleware, specifically the Imperative Web Server. It is exploitable remotely without authentication over HTTP and can result in unauthorized modification and disclosure of data accessible through Helidon. The vulnerability's scope extends beyond Helidon itself, potentially impacting other Oracle products that rely on it. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with confidentiality and integrity impacts and no availability impact. The affected versions are 3.0.0 through 3.2.17 inclusive, and 3.2.18. Oracle has published a Critical Security Patch Update in August 2026 addressing this and other vulnerabilities, recommending prompt patch application.

An unauthenticated attacker with network access can exploit this vulnerability to gain unauthorized read access to some Helidon accessible data and unauthorized update, insert, or delete access to other data. This compromises confidentiality and integrity of data handled by Helidon and may affect additional Oracle products that depend on Helidon. There is no impact on availability. The vulnerability is rated high severity with a CVSS score of 7.2.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update that address this vulnerability. Customers are strongly advised to apply these patches promptly to affected Helidon versions (3.0.0 through 3.2.19 and 4.0.0 through 4.5.2 as per advisory, with the vulnerability specifically noted in 3.0.0 to 3.2.18). Staying on actively supported versions and applying Oracle's security patches without delay is the recommended mitigation. No alternative or temporary mitigations are indicated in the advisory.