Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data as well as unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:18:17.167Z",
  "pubdate": "2026-08-18T21:18:17.167Z",
  "executiveSummary": "An easily exploitable security vulnerability has been identified within the Imperative Web Server component of the Oracle Fusion Middleware product, specifically affecting Helidon version 3.2.18. This vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the affected Helidon instance. Successful exploitation of this flaw can lead to severe security implications, including unauthorized access to critical data, complete access to all data accessible by Helidon, and unauthorized update, insert, or delete access to a subset of Helidon-accessible data. The vulnerability presents a significant risk to organizational data confidentiality and integrity. Based on the Common Vulnerability Scoring System (CVSS) version 3.1, the vulnerability is assigned a Base Score of 8.2 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. The attack vector is network-based (AV:N), attack complexity is low (AC:L), privileges required are none (PR:N), user interaction is not required (UI:N), and the scope is unchanged (S:U), resulting in high confidentiality impact (C:H) and low integrity impact (I:L) with no availability impact (A:N). Exploitation requires no prior authentication or user interaction, lowering the barrier for potential malicious actors targeting exposed instances.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Helidon version 3.2.18. The flaw exposes weaknesses in how incoming HTTP requests are processed, permitting unauthorized manipulation and retrieval of sensitive data managed by the application framework. The attack vector is strictly network-based, meaning any adversary capable of establishing a network connection to the HTTP service hosted by Helidon can initiate an attack. The exploitation method leverages crafted HTTP requests designed to bypass existing access controls or authorization boundaries enforced by the Imperative Web Server. Because the vulnerability requires zero privileges (PR:N) and no user interaction (UI:N), an unauthenticated attacker can directly interact with the vulnerable endpoints over the network (AV:N) with low attack complexity (AC:L). Upon successful transmission of the malicious HTTP payload, the Imperative Web Server fails to adequately validate or restrict access to backend data resources. This breakdown in request handling and authorization enforcement allows the attacker to execute unauthorized read operations, granting access to critical or complete Helidon-accessible data streams, thereby compromising confidentiality (C:H). Furthermore, the flaw permits the execution of unauthorized data modification operations, specifically enabling the attacker to insert, update, or delete a subset of the accessible data, impacting data integrity (I:L). The scope of the vulnerability remains unchanged (S:U), as the security impact is contained within the vulnerable Helidon component itself without directly escalating privileges to the underlying operating system kernel or separate security contexts. Post-exploitation impact is characterized by unauthorized data exfiltration of critical assets and potential corruption or tampering of application data stores reachable through the Imperative Web Server component."
}