This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is exploitable remotely without authentication over HTTP, enabling attackers to compromise Helidon and perform unauthorized operations on critical data. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. The affected versions explicitly include >=4.0.0 <=4.4.1 and =4.5.0. Oracle has published an advisory as part of its August 2026 Critical Security Patch Update, which addresses this and many other vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible via Helidon, as well as unauthorized access to such data. This compromises confidentiality and integrity of the affected system's data, potentially leading to significant operational and security consequences.

Oracle has released security patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to affected versions of Helidon. Staying on actively supported versions and timely patching is critical to mitigate this vulnerability. No indication of alternative mitigations or temporary fixes is provided by the vendor advisory.