This vulnerability affects Oracle Helidon version 4.5.3 and allows an unauthenticated attacker with network access via HTTP to perform unauthorized data manipulation (update, insert, delete) and unauthorized read access to some data. Additionally, the attacker can cause a partial denial of service on Helidon. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 score of 8.3. The advisory notes that while the vulnerability is in Helidon, attacks may impact other products as well (scope change). Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for Helidon 4.5.3. The vendor strongly recommends applying security patches promptly to mitigate risks.

An attacker can exploit this vulnerability remotely without authentication to gain unauthorized update, insert, or delete access to some Helidon accessible data, unauthorized read access to a subset of data, and cause a partial denial of service. This results in confidentiality, integrity, and availability impacts on the affected system. The vulnerability's scope change means that other products relying on Helidon may also be affected.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory. However, the advisory content provided does not explicitly confirm the availability of a specific patch for Helidon version 4.5.3. Customers should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Oracle strongly recommends applying all relevant security patches without delay and remaining on actively supported versions. Until a patch is applied, consider restricting network access to Helidon services to trusted sources only.