Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-18T21:18:17.930Z",
  "pubdate": "2026-08-18T21:18:17.930Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 3.2.18. This security flaw can be leveraged by an unauthenticated remote attacker with network access via the HTTP protocol to fully compromise the affected application instance.\nSuccessful exploitation of this vulnerability grants unauthorized actors extensive privileges, including the ability to perform unauthorized creation, deletion, and modification of critical or accessible data. Furthermore, attackers can gain unauthorized read access to critical data and induce a partial denial of service (partial DoS) condition against the Helidon service.\nThe vulnerability carries a CVSS 3.1 Base Score of 9.4, indicating severe risks to confidentiality, integrity, and availability. The associated CVSS vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), highlighting that the attack vector is network-based with low attack complexity, requiring no privileges or user interaction.\nOrganizations utilizing the affected Helidon version face high risk exposure, as malicious actors can compromise data integrity and confidentiality while disrupting service availability without requiring prior authentication or internal network positioning.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.18. The root cause stems from insufficient validation or improper access control enforcement within the HTTP request processing pipeline handling network traffic.\nThe attack flow begins when an unauthenticated attacker transmits a specifically crafted HTTP request across the network to the exposed Helidon Imperative Web Server endpoint. Because the application fails to adequately authenticate or authorize incoming HTTP traffic, the request bypasses security boundaries.\nDuring exploitation, the low complexity attack vector allows the payload to execute without requiring any prior privileges or user interaction. The network exposure of the HTTP service exposes the underlying logic flaws directly to external actors.\nPost-exploitation impacts are severe. With unauthorized access achieved, the attacker can manipulate critical data stores, resulting in arbitrary creation, deletion, or modification of Helidon-accessible data. Additionally, unauthorized extraction of confidential information occurs. The payload behavior may also trigger resource exhaustion or destabilization of request handling threads, leading to a partial denial of service (partial DoS) condition."
}