The vulnerability in Oracle Helidon 4.5.0 (component: Imperative Web Server) allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized read access to some Helidon accessible data, as well as the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Oracle’s August 2026 Critical Security Patch Update advisory lists Helidon among affected products and provides patch availability information, emphasizing the importance of applying patches without delay.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized read and write access to some data managed by Helidon, potentially altering or deleting data. Additionally, the attacker can cause a partial denial of service, impacting availability. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update that addresses this vulnerability. Customers using Helidon 4.5.0 should apply the relevant patches from the August 2026 Critical Security Patch Update as soon as possible. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks.