This vulnerability in Oracle Helidon (Imperative Web Server component) allows unauthenticated remote attackers to compromise the system via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data, and unauthorized read access to a subset of data. The vulnerability affects Helidon versions from 1.0.0 up to and including 1.4.19. It has a CVSS 3.1 score of 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality (low) and integrity (high) but no impact on availability. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

An attacker with network access via HTTP can exploit this vulnerability without authentication to gain unauthorized access to Helidon data. This includes the ability to create, delete, or modify critical data or all accessible data, and to read some subset of data without authorization. The impact affects confidentiality and integrity of data but does not affect availability. This could lead to significant data compromise within affected Helidon deployments.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Users of Oracle Helidon versions 1.0.0 through 1.4.19 should apply the relevant patches promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.