Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:18:18.763Z",
  "pubdate": "2026-08-18T21:18:18.763Z",
  "executiveSummary": "An easily exploitable security vulnerability has been identified within the Helidon product of Oracle Fusion Middleware, specifically residing in the Imperative Web Server component.\nThe flaw allows unauthenticated remote attackers with network access via HTTP to compromise the affected Helidon instance completely.\nSuccessful exploitation of this vulnerability results in severe security consequences, granting unauthorized actors the ability to perform creation, deletion, or modification operations on critical data, alongside gaining unauthorized read access to sensitive or all Helidon-accessible data.\nThe vulnerability carries a CVSS 3.1 Base Score of 9.1, reflecting high impacts on both confidentiality and integrity.\nExploitation requires no privileges and no user interaction, making it a high-risk vector for malicious actors targeting exposed network services.\nThe only confirmed affected supported version at the time of disclosure is version 4.5.0.",
  "technicalDetails": "The vulnerability exists within the Imperative Web Server component of Oracle Helidon version 4.5.0.\nIt is exposed remotely via the HTTP protocol, allowing external network attackers to interact directly with the vulnerable service without prior authentication.\nThe attack flow begins when an unauthenticated threat actor leverages network accessibility to send specially crafted HTTP requests to the Imperative Web Server.\nDue to insufficient security controls or improper input handling within the component, the application fails to adequately restrict unauthorized operations.\nThis permits the attacker to bypass intended authorization boundaries and interact directly with underlying application logic and data stores.\nThe exploitation prerequisites are minimal, requiring only network connectivity to the target Helidon instance, with an attack complexity rated as low (AC:L).\nFurthermore, the attack vector (AV:N) dictates that the vulnerability can be exploited across a network without requiring physical access, local system accounts, or user interaction (UI:N).\nOnce the request is processed by the vulnerable Imperative Web Server, the payload dictates the post-exploitation behavior.\nAttackers can leverage this unauthorized access to compromise data integrity by creating, modifying, or deleting critical application data.\nConcurrently, the vulnerability facilitates severe confidentiality breaches by granting the attacker complete access to read all data accessible to the Helidon environment.\nThe CVSS 3.1 vector is explicitly defined as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating that while confidentiality and integrity impacts are high, availability (A) remains unaffected."
}