This vulnerability affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized modification and disclosure of some accessible data and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects that the attack requires no privileges or user interaction and can be conducted remotely with low complexity. Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 4.5.0 among affected products and versions and provides patch availability documentation. The advisory emphasizes the importance of applying patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized read access to some Helidon accessible data, unauthorized update, insert, or delete access to some data, and the ability to cause a partial denial of service. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without authentication or user interaction, increasing the risk of compromise if unpatched.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the official patches promptly to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified in the advisory.