This vulnerability affects Oracle Helidon version 1.4.19, specifically the Imperative Web Server component. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized actions including creation, deletion, or modification of critical data or gaining full access to all data accessible by Helidon. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's August 2026 Critical Security Patch Update advisory lists Helidon 1.4.19 as affected and urges customers to apply security patches without delay. The advisory does not explicitly confirm the availability of a patch for this specific version, so patch status remains unconfirmed.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Helidon. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely without authentication, increasing risk.

Oracle strongly recommends that customers remain on actively-supported versions and apply security patches promptly. The August 2026 Critical Security Patch Update advisory includes Helidon 1.4.19 among affected products. However, the advisory does not explicitly confirm patch availability for this version. Therefore, patch status is not yet confirmed—check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Until patches are applied, restrict network access to Helidon HTTP services where possible.