This vulnerability affects the Helidon product of Oracle Fusion Middleware, specifically the Imperative Web Server component. It is exploitable remotely without authentication over HTTP, enabling attackers to compromise the system and alter critical data. The CVSS 3.1 base score is 8.6, reflecting high impact on data integrity with no impact on confidentiality or availability. The vulnerability affects Helidon versions from 3.0.0 up to and including 3.2.19, as well as version 3.2.20. The attack surface includes network access via HTTP, and successful exploitation can lead to unauthorized data manipulation. Oracle's advisory is part of a broader Critical Security Patch Update released in August 2026, which addresses this and many other vulnerabilities.

Successful exploitation allows unauthenticated attackers to create, delete, or modify critical data or all data accessible via Helidon, severely impacting data integrity. There is no reported impact on confidentiality or availability. The vulnerability's scope change indicates potential impact on additional Oracle products that use Helidon. The CVSS score of 8.6 confirms a high severity level focused on integrity compromise.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant patches promptly to affected Helidon versions. Staying on actively supported versions and applying Oracle's security patches without delay is the recommended mitigation. No alternative or temporary mitigations are specified in the advisory.