Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-18T21:18:18.050Z",
  "pubdate": "2026-08-18T21:18:18.050Z",
  "executiveSummary": "An unauthenticated vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0, presenting severe risks to organizational data security and service availability.\nThe vulnerability is remotely exploitable over network protocols via HTTP without requiring any user interaction, privileges, or prior authentication, lowering the attack barrier significantly for malicious actors.\nSuccessful exploitation of this flaw grants unauthorized attackers comprehensive capabilities, including the creation, modification, and deletion of critical data, complete unauthorized access to all Helidon accessible data, and the ability to induce a partial denial of service (partial DOS) condition against the affected Helidon instance.\nGiven the high CVSS 3.1 Base Score of 9.4 with maximum confidentiality and integrity impacts alongside high availability disruption potential, this vulnerability poses an extreme operational risk that requires immediate remediation to prevent unauthorized data exposure, data corruption, and service degradation.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0.\nThe attack vector is network-based (AV:N), allowing remote adversaries to interact directly with the vulnerable HTTP service without requiring local access or physical proximity.\nThe attack complexity is low (AC:L), indicating that exploitation does not depend on complex preconditions, race conditions, or hard-to-reproduce environmental states.\nNo privileges (PR:N) and no user interaction (UI:N) are required, enabling automated scanning frameworks and unauthenticated scripts to execute attacks successfully against exposed endpoints.\nThe security scope is unchanged (S:U), meaning the vulnerability directly impacts the core resources managed by the vulnerable Helidon component rather than spilling over into underlying host system components beyond the application's direct access boundary.\nThe attack flow begins when an unauthenticated attacker crafts specialized HTTP requests directed at the network-exposed Imperative Web Server.\nDue to insufficient input validation, authorization checks, or state handling within the vulnerable component, the malicious HTTP payload bypasses security controls.\nUpon successful processing of the payload, the attacker achieves unauthorized read, write, and deletion capabilities over critical application data and all accessible Helidon stores.\nSimultaneously, the payload can trigger resource exhaustion or operational faults within the Imperative Web Server, resulting in a partial denial of service (partial DOS) that degrades application responsiveness and availability for legitimate users.\nThe impact spans high confidentiality (C:H) and high integrity (I:H) due to data compromise and unauthorized manipulation, combined with low-to-moderate availability impact (A:L) reflecting the partial denial of service capability."
}