This vulnerability affects Oracle Helidon 1.4.20, specifically in the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to compromise the product by performing unauthorized data modification actions such as update, insert, or delete on some accessible data. The CVSS 3.1 base score is 3.7, indicating a low severity with integrity impact only. The vulnerability is considered difficult to exploit due to the required conditions. Oracle’s August 2026 Critical Security Patch Update advisory lists Helidon among affected products and versions, implying patches are available, but the advisory does not explicitly confirm the patch status for this specific CVE.

Successful exploitation can lead to unauthorized modification of some accessible data in Helidon, impacting data integrity. There is no impact on confidentiality or availability. The vulnerability requires network access via HTTP and is difficult to exploit, limiting the likelihood and scope of attacks.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which includes patches for Helidon versions 1.4.19 and 1.4.20 among others. Customers should remain on actively supported versions and apply security patches promptly to mitigate this vulnerability. Patch status for this specific CVE is not explicitly confirmed, so checking the vendor advisory for the latest patch availability and installation instructions is advised.