This vulnerability in Oracle Helidon 4.5.0's Imperative Web Server component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality and integrity impact and no availability impact. The vendor advisory does not explicitly confirm a patch but references a Critical Security Patch Update containing many fixes, including for Helidon 4.5.0, and urges customers to apply patches without delay.

An attacker can remotely and without authentication access Helidon 4.5.0 over HTTP to read and modify some accessible data, potentially compromising confidentiality and integrity of that data. There is no impact on system availability. This could lead to unauthorized data manipulation and disclosure within the scope of Helidon accessible data.

Oracle strongly recommends that customers remain on actively supported versions and apply available security patches without delay. Although no explicit patch or remediation level is stated for this CVE, the vendor advisory references a Critical Security Patch Update that includes fixes for Helidon 4.5.0. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions and apply the relevant updates promptly.