This vulnerability in Oracle Helidon (component: Imperative Web Server) permits an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation results in unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The vulnerability affects Helidon versions 4.0.0 through 4.5.2 and 4.5.3. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, with low confidentiality and integrity impacts, and no availability impact. The vulnerability may also impact other Oracle products due to scope change. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability but does not explicitly confirm patch availability for Helidon in the provided content.

An unauthenticated attacker can remotely exploit this vulnerability over HTTP to gain unauthorized read and write access to some data within Helidon, potentially leading to data compromise. The vulnerability affects confidentiality and integrity but does not impact availability. Additionally, the scope change indicates that other Oracle products relying on Helidon may also be affected.

Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. The vendor advisory references a Critical Security Patch Update (August 2026) that addresses this and many other vulnerabilities. However, the provided advisory content does not explicitly confirm the availability of a specific patch for Helidon versions 4.0.0 through 4.5.3. Users should consult the official Oracle Critical Security Patch Update documentation and apply relevant patches as soon as they become available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.