Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T21:18:18.990Z",
  "pubdate": "2026-08-18T21:18:18.990Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting version 4.5.0.\nThe vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the affected system without requiring any user interaction or privileges.\nSuccessful exploitation of this security flaw results in unauthorized read, update, insert, and delete access to a subset of data accessible via Helidon, compromising both data confidentiality and data integrity.\nThe inherent risks include unauthorized data tampering and information disclosure, which can affect the overall security posture of applications deployed on the vulnerable framework.\nGiven that the attack vector is network-based with low attack complexity and zero authentication or privilege requirements, immediate attention to remediation is warranted upon patch availability.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0.\nThe root cause permits unauthenticated network-based HTTP interactions to bypass intended authorization boundaries, leading to unauthorized data manipulation and retrieval.\nAttackers leverage standard HTTP requests sent directly over the network to interact with the vulnerable Imperative Web Server component without needing prior authentication or valid user credentials.\nThe exploitation method relies on the server processing maliciously crafted or unauthorized HTTP inputs that fail to properly enforce access controls on accessible data subsets.\nThe attack flow proceeds as follows: First, the unauthenticated attacker establishes network connectivity to the targeted Helidon HTTP endpoint. Second, the attacker transmits specifically formatted HTTP requests designed to target unprotected or improperly restricted data resources. Third, the Imperative Web Server processes the incoming requests and executes the unauthorized data operations.\nPost-exploitation impacts include unauthorized read access to a subset of accessible data, as well as unauthorized update, insert, or delete access to data handled by the application.\nThe CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates that the vulnerability is exploitable over the network (AV:N), has low attack complexity (AC:L), requires no privileges (PR:N), requires no user interaction (UI:N), maintains an unchanged scope (S:U), and impacts confidentiality (C:L) and integrity (I:L) with no impact on availability (A:N)."
}