Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Helidon executes to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data as well as unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:18:16.510Z",
  "pubdate": "2026-08-18T21:18:16.510Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This security flaw enables a low-privileged attacker with local logon access to the underlying infrastructure where the Helidon runtime executes to compromise the application. Successful exploitation of this vulnerability results in significant security compromises, specifically granting unauthorized access to critical data, complete access to all data accessible by Helidon, and unauthorized update, insertion, or deletion capabilities over a subset of Helidon-accessible data. The Common Vulnerability Scoring System (CVSS) version 3.1 assigns a base score of 6.1 with the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, highlighting local attack vector mechanics, low complexity, low privilege requirements, and zero user interaction requirements while impacting confidentiality and integrity. Risk implications involve severe data exposure and integrity degradation of application-managed resources, mandating prompt administrative intervention and strict host-level isolation controls.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 4.5.0. The root cause stems from inadequate access controls, insecure resource permissions, or improper handling of local state within the execution environment that permits a locally authenticated user to interact with or manipulate the Helidon runtime. Because the attack vector is local (AV:L), the adversary must already possess interactive or programmatic shell access to the host operating system where the vulnerable Helidon instance is deployed. The attack complexity is low (AC:L), requiring minimal specialized conditions or race conditions to successfully execute the exploit. Furthermore, the attacker requires only low privileges (PR:L) on the local host, meaning standard unprivileged user accounts provisioned on the infrastructure can initiate the attack path without requiring administrative or root credentials. No user interaction (UI:N) is mandated, allowing automated or scripted exploitation once the initial local access barrier is crossed.\nThe attack flow proceeds in distinct phases. First, the low-privileged attacker establishes a session or executes a script on the infrastructure hosting the Helidon 4.5.0 instance. Second, leveraging the local attack vector, the attacker targets the vulnerable Imperative Web Server component via internal IPC mechanisms, insecurely shared file system artifacts, misconfigured local sockets, or exposed management interfaces intended exclusively for internal runtime processes. Third, the attacker bypasses intended boundary checks enforced by the application architecture due to the insufficient privilege separation or permissive local access controls inherent in the affected version. Finally, the payload executes post-exploitation behaviors that realize the impact metrics: reading highly sensitive data stores managed by the application, exfiltrating critical configuration or business data, and injecting, modifying, or deleting records within the application's data layer where integrity permissions are improperly enforced. The Scope remains unchanged (S:U), as the compromise is contained within the boundaries of the local Helidon application execution context rather than breaking out to hypervisor or broader kernel spaces."
}