This vulnerability in Oracle Helidon (component helidon-integrations-neo4j) permits an unauthenticated attacker who has physical access to the communication segment connected to the Helidon hardware to compromise the system. The attacker can gain unauthorized creation, deletion, or modification access to critical data or all data accessible by Helidon. The CVSS 3.1 vector indicates attack complexity is high, no privileges or user interaction are required, and the attack vector is adjacent network (physical communication segment). The impact affects confidentiality and integrity but not availability. The affected versions are 3.0.0 through 3.2.20 and 4.0.0 through 4.5.4. Oracle has included this fix in its September 2026 Critical Security Patch Update.

Successful exploitation results in unauthorized creation, deletion, or modification of critical or all Helidon accessible data, as well as unauthorized access to such data. This compromises confidentiality and integrity of the data managed by Helidon. There is no impact on availability. The attack requires physical access to the communication segment, making exploitation difficult.

Oracle has released patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Users should apply the relevant patches for Helidon versions 3.0.0-3.2.20 and 4.0.0-4.5.4 without delay. Since the vulnerability requires physical access to the communication segment, physical security controls also help mitigate risk. Patch status is confirmed by the vendor advisory. No additional vendor mitigation instructions are provided.