This vulnerability affects Oracle Helidon, specifically versions >=4.0.0 <=4.5.2 and =4.5.3, in the Imperative Web Server component. It is easily exploitable by unauthenticated attackers over HTTP, allowing unauthorized modification and reading of some accessible data and causing partial denial of service. The CVSS vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 patches, recommending customers apply patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized update, insert, or deletion of some Helidon accessible data, unauthorized read access to a subset of data, and partial denial of service conditions. This compromises confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the relevant patches from this update promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No additional mitigation steps are indicated beyond patching.