CVE-2026-83488 is a vulnerability in the helidon-microprofile-security component of Oracle Fusion Middleware's Helidon product. It affects versions 4.0.0 through 4.5.4. The flaw allows an attacker with low privileges and network access via HTTP to compromise Helidon by gaining unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impacts on confidentiality and integrity but not availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some data accessible via Helidon. This compromises confidentiality and integrity of the affected data. There is no reported impact on availability. The vulnerability requires low privileges and network access via HTTP, making it relatively easy to exploit if unpatched.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Helidon versions 4.0.0 through 4.5.4 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this vulnerability. No additional vendor advisory mitigation instructions indicate that other actions are required.