Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T21:18:19.923Z",
  "pubdate": "2026-08-18T21:18:19.923Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon, specifically affecting version 4.5.1. This security flaw allows unauthenticated remote attackers to compromise the system over the network utilizing the HTTP protocol.\nThe vulnerability possesses a CVSS 3.1 Base Score of 7.2 with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The impact profile indicates a scope change, meaning that successful exploitation of Helidon may significantly compromise additional integrated or associated products beyond the immediate boundary of the vulnerable application.\nThe attacker capabilities require no prior authentication, low attack complexity, and zero user interaction, making it highly accessible to external threat actors with network connectivity. Successful exploitation grants unauthorized read access to a subset of Helidon-accessible data, alongside unauthorized update, insert, or delete capabilities against targeted data assets.\nGiven the network exposure and lack of authentication requirements, organizations utilizing the affected Helidon version face notable risk regarding data integrity and confidentiality. Immediate remediation or vendor-supplied patching is strongly advised to neutralize the threat vector.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Helidon product within Oracle Fusion Middleware, specifically targeting version 4.5.1. The root cause stems from improper input validation, access control enforcement, or request handling logic within the web server implementation, which fails to adequately restrict unauthorized operations originating from network-based HTTP requests.\nExploitation of this vulnerability is executed remotely over the network via standard HTTP protocol exchanges. Because the flaw requires low attack complexity and no prior authentication (PR:N) or user interaction (UI:N), an unauthenticated threat actor can directly interact with the exposed Imperative Web Server endpoints to transmit maliciously crafted requests.\nThe attack flow proceeds as follows: First, the attacker identifies a network-accessible instance of Helidon version 4.5.1 running the vulnerable Imperative Web Server. Second, the attacker crafts an HTTP request designed to bypass intended security boundaries or manipulate data structures handled by the vulnerable component. Third, upon receiving the request, the Imperative Web Server processes the input without proper authorization checks or validation constraints.\nDue to the scope change (S:C) characteristic of this vulnerability, the impact extends beyond the immediate Helidon runtime environment. The payload behavior and subsequent post-exploitation impact allow the adversary to execute unauthorized data modifications—specifically performing update, insert, and delete operations—as well as exfiltrating a subset of sensitive data accessible via the Helidon framework.\nThe combination of network exposure, lack of privilege requirements (PR:N), and the ability to influence out-of-scope system components elevates the severity of the attack, leading to degraded confidentiality and compromised data integrity across affected architectures."
}