This vulnerability affects Oracle Helidon 3.2.18, specifically the Imperative Web Server component, allowing an unauthenticated attacker with network access via HTTP to gain unauthorized access and perform critical data operations such as creation, deletion, or modification. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is included in Oracle's August 2026 Critical Security Patch Update, which addresses numerous vulnerabilities across Oracle products. The advisory strongly recommends applying patches promptly but does not explicitly confirm the availability of a patch for this specific version of Helidon.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data in Helidon, leading to a complete compromise of data confidentiality and integrity. There is no impact on availability according to the CVSS vector. The vulnerability allows unauthenticated remote attackers to perform these actions via HTTP, increasing the risk of widespread compromise if exploited.

Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability and recommends that customers apply security patches without delay. However, the advisory does not explicitly confirm the availability of a patch for Helidon version 3.2.18. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, restrict network access to Helidon services where possible to reduce exposure.