Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-18T21:18:19.577Z",
  "pubdate": "2026-08-18T21:18:19.577Z",
  "executiveSummary": "A security vulnerability has been identified within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting supported version 3.2.18.\nThis vulnerability is categorized as a security flaw enabling unauthorized data access and modification, impacting both data confidentiality and integrity without affecting system availability.\nThe risk implication involves a low-privileged threat actor leveraging network access via HTTP to compromise the affected Helidon instance, leading to the unauthorized read, update, insert, or delete access to a subset of accessible data.\nSuccessful exploitation is classified as difficult and requires specific conditions, including low privileges and network connectivity, but does not necessitate user interaction.\nOrganizations utilizing the impacted version face potential data exposure and unauthorized state manipulation within the application context, necessitating prompt defensive measures aligned with vendor advisories.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.18, specifically affecting how HTTP requests are processed and authorized.\nThe attack vector is network-based (AV:N), meaning the attacker requires remote network connectivity to target the vulnerable HTTP server interface.\nThe attack complexity is rated as high (AC:H), indicating that successful exploitation requires specific preconditions, precise timing, or non-standard configurations to bypass existing controls.\nThe required privilege level is low (PR:L), signifying that the attacker must authenticate to the application with standard, non-administrative user credentials before initiating the attack sequence.\nUser interaction is not required (UI:N), allowing the attacker to execute the attack independently without social engineering or user intervention.\nThe attack flow begins with the authenticated low-privileged attacker crafting specialized HTTP requests directed at the Imperative Web Server component.\nDue to insufficient validation, improper access control enforcement, or flawed request handling within the vulnerable component, the crafted HTTP payloads bypass intended authorization boundaries.\nPost-exploitation impacts include unauthorized read access to a subset of Helidon accessible data, violating confidentiality, as well as unauthorized update, insert, or delete access to data, violating integrity.\nThe vulnerability scope is unchanged (S:U), meaning the impact is restricted to the vulnerable Helidon component itself and does not directly escalate to underlying host resources or broader security domains.\nThe overall CVSS 3.1 base score is 4.2, represented by the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N."
}