This vulnerability affects Oracle Helidon version 4.5.0 and allows an unauthenticated attacker with network access via HTTP to compromise the product. Exploitation requires user interaction from a third party and can result in unauthorized read and modification (update, insert, delete) of accessible data within Helidon. The vulnerability has a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts. The vulnerability may also affect other products due to scope change. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm patch availability or remediation level for this specific vulnerability, but it is included in Oracle's August 2026 Critical Security Patch Update, which contains numerous security patches.

Successful exploitation can lead to unauthorized read access and unauthorized update, insert, or delete operations on some data accessible by Helidon. This compromises confidentiality and integrity of the affected data. The vulnerability requires user interaction and network access but no authentication. The scope of impact may extend beyond Helidon to additional Oracle products. There are no reports of active exploitation in the wild at this time.

Oracle's August 2026 Critical Security Patch Update includes security patches addressing this vulnerability among many others. Customers are strongly advised to apply the relevant patches from this update promptly to mitigate the risk. Since the vendor advisory does not explicitly state otherwise, patch status should be confirmed by reviewing the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No alternative mitigations or workarounds are specified in the advisory.