This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is exploitable remotely without authentication over HTTP and results in unauthorized disclosure of some Helidon accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact. The affected versions are 4.0.0 through 4.4.1 inclusive, and 4.5.0. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory but no explicit patch link or fixed version is provided in the input data.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to read a subset of data accessible through Helidon without authorization. There is no impact on integrity or availability. The confidentiality impact is limited but unauthorized data disclosure can have operational or privacy consequences depending on the data exposed.

Oracle strongly recommends applying security patches promptly and staying on actively supported versions. This vulnerability is included in the August 2026 Critical Security Patch Update advisory. However, the input data does not explicitly confirm the availability of a patch or fixed version for Helidon. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation instructions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.