This vulnerability in Oracle Helidon (Imperative Web Server component) allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized read access to some Helidon accessible data, along with the ability to cause a partial denial of service. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a low level. Affected versions explicitly include 4.0.0 through 4.4.1 and 4.5.0.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized read and write access to some data managed by Helidon, potentially compromising data confidentiality and integrity. Additionally, the attacker can cause a partial denial of service, impacting availability. This could disrupt normal operations and lead to data manipulation or leakage.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to affected Helidon versions. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as fixed in versions later than 4.5.0 (e.g., 4.5.2). Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.