Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-18T21:18:19.103Z",
  "pubdate": "2026-08-18T21:18:19.103Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 3.2.18. This security flaw allows an unauthenticated network attacker leveraging HTTP communication to compromise the affected system. Successful exploitation of this vulnerability mandates human interaction from a third party other than the attacker. Although the underlying weakness resides entirely within the Helidon product, successful attacks induce a scope change that may significantly impact additional integrated or collateral products.\nThe consequences of successful exploitation include unauthorized read access to a subset of Helidon-accessible data, alongside unauthorized update, insert, or delete access to specific sensitive data repositories. The Common Vulnerability Scoring System (CVSS) version 3.1 assigns a base score of 6.1 with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting network vector exposure, low attack complexity, lack of required privileges, necessary user interaction, and a security scope alteration affecting confidentiality and integrity.",
  "technicalDetails": "The vulnerability is localized within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.18. The root cause stems from improper input validation or insufficient handling of incoming HTTP requests processed by the web server framework, enabling malicious actors to manipulate data flows under specific conditions.\nThe attack vector is network-based (AV:N), allowing remote unauthenticated threat actors (PR:N) to interact directly with the Helidon instance over the HTTP protocol with low attack complexity (AC:L). However, direct exploitation requires explicit human interaction (UI:R) from a victim, such as a user or administrator browsing to a maliciously crafted link or interacting with a manipulated HTTP response context.\nDuring the attack flow, the adversary crafts a specialized HTTP payload designed to exploit the Imperative Web Server processing logic. Upon transmission to the vulnerable Helidon endpoint, the presence of user interaction facilitates the execution or processing of the malicious request within the application context. Because the vulnerability exhibits a scope change (S:C), the compromise extends beyond the immediate boundary of the Helidon instance, potentially affecting secondary downstream products or services managed within the same architectural ecosystem.\nThe post-exploitation impact spans both data confidentiality and integrity. Successful payload execution grants the attacker unauthorized read access to a subset of data accessible by Helidon, while concurrently permitting unauthorized create, update, and delete (IID) capabilities against designated Helidon-accessible data stores. Availability remains unaffected (A:N), as the vulnerability does not directly facilitate denial-of-service conditions."
}