Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:17:50.163Z",
  "pubdate": "2026-08-18T21:17:50.163Z",
  "executiveSummary": "An easily exploitable security vulnerability exists within the Imperative Web Server component of Oracle Helidon version 3.2.19, which forms part of Oracle Fusion Middleware. This network-based vulnerability allows an unauthenticated attacker to leverage HTTP communication vectors to compromise the affected system. Successful exploitation requires human interaction from an individual other than the attacker and results in a scope change, meaning that successful attacks may significantly impact additional products beyond Helidon itself. The compromise yields unauthorized read access to a subset of Helidon-accessible data, as well as unauthorized update, insert, or delete access to some of the accessible data. With a CVSS 3.1 Base Score of 6.1, the primary risk vectors are confined to confidentiality and integrity impacts, while availability remains unaffected. The necessity of user interaction combined with network exposure presents a notable risk for environments utilizing the unsupported affected version without adequate validation controls.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Helidon version 3.2.19. The root cause enables remote attackers to interact with the web server via HTTP protocols, exploiting weaknesses in how incoming requests or responses are handled within the component. The attack vector is strictly network-based (AV:N), featuring low attack complexity (AC:L) and requiring zero prior authentication (PR:N). However, successful exploitation mandates user interaction (UI:R), implying that an authenticated or browsing user must perform a specific action, such as clicking a malicious link or interacting with crafted content supplied by the attacker. Furthermore, the vulnerability exhibits a scope change (S:C), indicating that successful exploitation breaks security boundaries, potentially compromising downstream or associated products interacting with the Helidon instance.\nThe step-by-step attack flow begins with the unauthenticated attacker crafting a malicious HTTP payload designed to target the Imperative Web Server component in Oracle Helidon 3.2.19. The attacker then induces a victim—via social engineering or other vectors requiring human interaction—to initiate an HTTP request or interact with the malicious content hosted or processed by the server. Upon processing the malicious input under the context of the user interaction, the vulnerability is triggered. This allows the attacker to bypass standard authorization controls within the scope of the web server. Post-exploitation impact includes unauthorized read operations against a subset of sensitive data accessible to Helidon, alongside unauthorized data manipulation capabilities such as updating, inserting, or deleting targeted data records. Because of the scope change attribute, the compromise may cascade to impact additional integrated products or middleware layers relying on the Helidon runtime."
}