This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is exploitable remotely without authentication over HTTP, enabling attackers to compromise Helidon by gaining unauthorized access to modify and read certain data and to cause partial denial of service conditions. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively but collectively scoring 7.3.

Successful exploitation can lead to unauthorized update, insertion, or deletion of some Helidon accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service affecting Helidon availability. This compromises data confidentiality, integrity, and availability to a limited extent.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to remediate this issue. The vendor advisory does not indicate that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as fixed in versions later than 4.5.0 (up to 4.5.2 per advisory).