This vulnerability in Oracle Helidon (Imperative Web Server component) enables an unauthenticated remote attacker to compromise the system via HTTP network access. Successful exploitation results in unauthorized access to critical or all data accessible through Helidon. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack requires no privileges or user interaction and impacts confidentiality only. The affected versions are from 3.0.0 up to and including 3.2.17, plus version 3.2.18. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes patches for Helidon versions up to 3.2.19.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data or all data accessible through Helidon. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users of affected Helidon versions (3.0.0 through 3.2.17 and 3.2.18) should apply the available patches promptly to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.