This vulnerability affects Oracle Helidon 4.5.0, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access over HTTP to perform unauthorized actions including creation, deletion, or modification of critical data, and unauthorized access to all data accessible via Helidon. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality and integrity impact. The vulnerability is included in Oracle's August 2026 Critical Security Patch Update advisory, which covers many products and versions. The advisory urges customers to apply patches without delay but does not explicitly confirm a patch for Helidon 4.5.0 in the provided content.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Helidon, as well as unauthorized access to all data accessible through Helidon. This compromises confidentiality and integrity of the affected system. There is no reported impact on availability. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. The vulnerability is included in the August 2026 Critical Security Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch for Helidon 4.5.0. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance and patch availability. Until a patch is applied, restrict network access to Helidon services where possible.