This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is exploitable remotely without authentication over HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible via Helidon, as well as unauthorized access to such data. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

An attacker can remotely and unauthenticatedly compromise Helidon to gain unauthorized access and control over critical or all accessible data. This includes the ability to create, delete, or modify data, which can severely impact data confidentiality and integrity. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released security patches for affected Helidon versions as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Staying on actively supported versions and timely patching are critical, as Oracle continues to observe attempts to exploit vulnerabilities that have already been patched. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.