This vulnerability in Oracle Helidon (Imperative Web Server component) affects versions 4.0.0 through 4.4.1 and 4.5.0. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized read and modification (update, insert, delete) of some accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impact. The vulnerability is publicly known and assigned CVE-2026-73911. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 patches released, recommending customers apply patches promptly.

Successful exploitation allows unauthorized read access to a subset of Helidon accessible data and unauthorized update, insert, or delete access to some data. This compromises confidentiality and integrity of affected data but does not impact availability. The attacker requires network access and low privileges but no user interaction. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers are strongly advised to apply the official patches promptly to remediate the issue. No alternative mitigations or workarounds are specified in the advisory. Remaining on actively supported versions and applying security patches without delay is recommended.