This vulnerability in Oracle Helidon (Imperative Web Server component) is exploitable remotely without authentication via HTTP. It permits unauthorized modification (update, insert, delete) and partial unauthorized reading of accessible data within Helidon. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting its network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with a scope change. The vulnerability affects Helidon versions >=4.0.0 <=4.4.1 and =4.5.0. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes patches for Helidon and many other Oracle products.

Successful exploitation allows an unauthenticated attacker to gain unauthorized read access to some data and unauthorized update, insert, or delete access to other data accessible via Helidon. This compromises data confidentiality and integrity but does not impact availability. The vulnerability's scope change means it may affect additional Oracle products that use Helidon. The CVSS score of 7.2 indicates a high-severity issue.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches promptly to affected Helidon versions. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigations or workarounds are specified in the advisory.