Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:20.163Z",
  "pubdate": "2026-08-18T21:18:20.163Z",
  "executiveSummary": "An unauthenticated information disclosure vulnerability has been identified within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.18. This security flaw allows remote attackers with network access via HTTP to bypass security controls and gain unauthorized read access to critical data or complete access to all data accessible by the Helidon application.\nThe vulnerability represents a significant risk to confidentiality without directly impacting data integrity or service availability. Exploitation requires no user interaction, low attack complexity, and zero privileges, making it easily exploitable over a standard network protocol. The absence of authentication requirements significantly lowers the barrier to entry for potential threat actors seeking to harvest sensitive information exposed by the affected application instance.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Helidon version 3.2.18. Specifically, the flaw stems from improper input validation, weak access control enforcement, or insecure resource handling during HTTP request processing, allowing unauthenticated remote clients to retrieve sensitive data that should otherwise be restricted.\nThe attack vector is network-based (AV:N), utilizing standard HTTP requests directed against the exposed Helidon web server endpoints. The attack complexity is rated as low (AC:L) because the vulnerability does not require specialized conditions, race conditions, or complex payload crafting to trigger. Furthermore, the exploit requires no prior authentication (PR:N) and no user interaction (UI:N) from application operators or clients.\nDuring a typical attack flow, an unauthenticated adversary initiates a crafted HTTP request targeting vulnerable routing or resource handlers within the Imperative Web Server. Due to insufficient authorization checks or path handling flaws within the component, the application fails to validate whether the requesting entity possesses the necessary privileges to access the requested resource. Consequently, the server processes the request and returns the sensitive payload in the HTTP response body.\nThe post-exploitation impact is strictly localized to confidentiality (C:H), resulting in unauthorized access to critical internal data or complete exposure of all information accessible within the scope of the Helidon runtime. Integrity (I:N) and availability (A:N) metrics remain unaffected, as the flaw does not facilitate data modification, deletion, or denial of service conditions."
}