This vulnerability affects Oracle Helidon 4.5.0 and allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and a high confidentiality impact with no integrity or availability impact. Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 4.5.0 among affected versions and provides patch availability documentation, implying that patches or mitigations exist within this update.

Successful exploitation can lead to unauthorized access to critical or all data accessible by Helidon 4.5.0. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication, increasing the risk of data exposure.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which provides targeted security fixes for Helidon 4.5.0 and other products. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. No indication exists that the vulnerability is already mitigated without patching. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.