This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. Versions 3.0.0 through 3.2.17 and 3.2.18 are impacted. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise Helidon, resulting in unauthorized creation, deletion, or modification of critical data or all data accessible through Helidon. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Helidon, compromising confidentiality and integrity. There is no impact on availability. This could result in significant data breaches or data manipulation within affected Helidon deployments.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to affected Helidon versions (3.0.0 through 3.2.19 and 4.0.0 through 4.5.2 as per the advisory). Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.