This vulnerability affects Oracle Helidon, specifically versions 4.0.0 to 4.4.1 and 4.5.0. It permits an unauthenticated attacker with network access over HTTP to compromise the product by gaining unauthorized read access to some data and unauthorized update, insert, or delete access to some accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability. The vulnerability is classified under CWE-284 (Improper Access Control). Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 security patches across multiple products, including Helidon, and strongly recommends applying patches promptly.

Successful exploitation allows an unauthenticated attacker to read some data and modify (update, insert, delete) some data accessible via Helidon, potentially compromising confidentiality and integrity of that data. There is no impact on availability. The vulnerability is exploitable over the network without authentication and requires low attack complexity.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available security patches promptly to mitigate this vulnerability. Staying on actively supported versions and timely patching are critical to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.