This vulnerability affects Oracle Helidon version 1.4.19, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical or all accessible data within Helidon. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates that the attack requires no privileges or user interaction and can be performed remotely with low complexity. The vulnerability is classified as critical with a base score of 9.1. Oracle's August 2026 Critical Security Patch Update advisory references Helidon 1.4.19 among affected products but does not explicitly confirm patch availability or remediation level for this version in the provided text.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Helidon 1.4.19. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of widespread compromise if left unmitigated.

Oracle's August 2026 Critical Security Patch Update advisory includes Helidon 1.4.19 among affected products but does not explicitly confirm patch availability or remediation for this specific vulnerability in the provided content. Therefore, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions to mitigate exploitation risks.