Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T21:18:16.280Z",
  "pubdate": "2026-08-18T21:18:16.280Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting version 4.5.0.\nThe vulnerability allows an unauthenticated remote attacker with network access via the HTTP protocol to achieve a complete system takeover of Helidon.\nWith a CVSS 3.1 Base Score of 9.8, the flaw presents maximum severity impacts across confidentiality, integrity, and availability.\nExploitation requires no privileges and no user interaction, operating over standard network vectors.\nThe inherent risks include total compromise of the affected application instance, unauthorized access to sensitive data, modification of critical system state, and complete denial of service.\nOrganizations running the affected version face immediate exposure to potential remote code execution or structural security bypasses originating from untrusted network perimeters.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically impacting version 4.5.0.\nThe root cause permits unauthenticated remote attackers to interact with vulnerable HTTP endpoints, bypassing intended security controls or memory safety boundaries within the web server architecture.\nExploitation is conducted remotely via the HTTP protocol without requiring any prior authentication, low privilege levels, or user interaction, fulfilling the network attack vector (AV:N/AC:L/PR:N/UI:N).\nThe step-by-step attack flow begins when an unauthenticated adversary crafts a malicious HTTP request targeting the exposed Imperative Web Server component.\nUpon receiving the request, the vulnerable Helidon component improperly processes the payload or underlying input vectors, resulting in unsafe execution states or memory corruption.\nThis processing flaw allows the attacker to execute arbitrary logic, resulting in the complete takeover of the Helidon runtime environment.\nPost-exploitation impact includes full control over the compromised process, complete confidentiality loss of processed data, integrity violation through arbitrary modifications, and absolute availability degradation.\nThe scope of the vulnerability is unchanged (S:U), but the impact on confidentiality (C:H), integrity (I:H), and availability (A:H) is total."
}