This vulnerability affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to compromise the system by gaining unauthorized update, insert, or delete access to some Helidon accessible data, as well as unauthorized read access to a subset of that data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and low confidentiality and integrity impacts. Oracle's advisory groups this vulnerability within a Critical Security Patch Update containing many fixes but does not explicitly confirm a patch for this version or vulnerability in the provided excerpt.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible through Helidon 4.5.0. This compromises data confidentiality and integrity but does not affect availability. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The provided advisory references a Critical Security Patch Update that includes many fixes, but patch availability for Helidon 4.5.0 specifically is not explicitly confirmed in the provided content. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch and remediation information. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.