This vulnerability affects Oracle Helidon versions >=4.0.0 <=4.4.1 and =4.5.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized data operations, including read, insert, update, and delete, on Helidon accessible data. Successful exploitation requires user interaction from a person other than the attacker and may impact other products beyond Helidon. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, low confidentiality and integrity impact, and no availability impact. Oracle has published this vulnerability in their August 2026 Critical Security Patch Update advisory but has not explicitly stated patch availability for Helidon in the provided content.

Exploitation can result in unauthorized read, insert, update, or delete access to some data accessible via Helidon, potentially compromising confidentiality and integrity of that data. The vulnerability requires user interaction and affects the security scope beyond Helidon itself, possibly impacting additional Oracle products. There is no reported availability impact. No known exploits in the wild have been reported.

Oracle strongly recommends applying security patches without delay as part of their Critical Security Patch Update process. However, the provided advisory content does not explicitly confirm patch availability or remediation status for Helidon versions affected by this vulnerability. Therefore, patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Customers should remain on actively supported versions and apply any available patches promptly.