This vulnerability affects Oracle Helidon version 3.2.18, specifically the Imperative Web Server component. An unauthenticated attacker with network access via HTTP can exploit this flaw to read a subset of data accessible by Helidon without authorization. The CVSS 3.1 vector indicates low attack complexity, no privileges required, and no user interaction needed, with confidentiality impact only. Oracle's August 2026 Critical Security Patch Update advisory references Helidon 3.2.18 among affected versions but does not explicitly confirm a patch or remediation status for this exact vulnerability. Customers are strongly advised to apply Oracle patches promptly to mitigate known vulnerabilities.

Successful exploitation results in unauthorized read access to some Helidon accessible data, impacting confidentiality. There is no impact on integrity or availability. The vulnerability is exploitable remotely without authentication or user interaction, increasing exposure risk. No known exploits in the wild have been reported at this time.

Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 3.2.18 as affected and recommends applying security patches without delay. However, the advisory does not explicitly confirm an available patch or remediation level for this vulnerability. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Customers should remain on actively supported versions and apply any relevant patches promptly once available.