This vulnerability affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. It allows an attacker with low privileges and network access via HTTP to compromise the system, resulting in unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality and integrity but not availability. The vendor advisory references Oracle's August 2026 Critical Security Patch Update, which includes multiple patches across Oracle products, but does not explicitly confirm a patch for this specific vulnerability. Oracle advises customers to remain on supported versions and apply patches without delay.

Successful exploitation allows unauthorized modification (update, insert, delete) and unauthorized reading of some Helidon accessible data, impacting confidentiality and integrity. There is no impact on availability. The vulnerability requires network access and low privileges, making it moderately exploitable. No known exploits in the wild have been reported.

Oracle strongly recommends that customers remain on actively supported versions and apply security patches promptly as provided in their Critical Security Patch Updates. The vendor advisory does not explicitly confirm a patch for this vulnerability; therefore, patch status is not yet confirmed. Customers should monitor Oracle's security alerts and apply any relevant patches when available. No vendor advisory states that no action is required or that the issue is already mitigated.