This vulnerability exists in the helidon-security-providers-idcs-mapper component of Oracle Helidon. It is exploitable remotely over the network with low attack complexity and requires low privileges, but no user interaction. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data within Helidon. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impacts. Oracle's September 2026 Critical Security Patch Update includes patches for affected Helidon versions 3.0.0-3.2.20 and 4.0.0-4.5.4. The vendor strongly recommends applying these patches promptly to mitigate the risk.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Helidon. This compromises confidentiality and integrity of the data but does not affect availability. The attacker requires network access via HTTP and low privileges to exploit the vulnerability.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update covering affected Helidon versions 3.0.0-3.2.20 and 4.0.0-4.5.4. Customers should apply these official patches without delay to remediate the vulnerability. Oracle advises remaining on actively supported versions and promptly applying security patches to prevent exploitation.