Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:20.843Z",
  "pubdate": "2026-08-18T21:18:20.843Z",
  "executiveSummary": "An unauthenticated, network-accessible vulnerability exists in the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component.\nThe vulnerability affects version 4.5.0 of the product and is categorized with a CVSS 3.1 Base Score of 7.5, reflecting a severe impact exclusively on data confidentiality without affecting integrity or availability.\nAn external attacker with standard network access via the HTTP protocol can exploit this flaw easily without requiring any user interaction, authentication credentials, or elevated privileges.\nSuccessful exploitation of this security defect grants the unauthorized adversary access to critical data or complete access to all data accessible by the Helidon runtime.\nThe risk implications are significant due to the low attack complexity and the lack of pre-requisite conditions, exposing sensitive application data to potential threat actors over the network.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Helidon version 4.5.0, exposing an improperly secured endpoint or handling mechanism accessible via standard HTTP communication protocols.\nThe root cause stems from insufficient access controls or improper handling of request contexts within the affected component, allowing unauthorized retrieval of restricted resources.\nExploitation is conducted entirely over the network via HTTP, requiring no prior authentication or administrative privileges.\nThe attack flow proceeds as follows: an unauthenticated threat actor crafts a malicious HTTP request directed at the vulnerable Imperative Web Server endpoint exposed by the Helidon framework. Due to the lack of adequate security validation and authorization enforcement within version 4.5.0, the server processes the request and returns sensitive data that should otherwise be restricted.\nThe payload behavior focuses on extracting confidential information rather than modifying system state or causing denial of service conditions.\nPost-exploitation impact includes unauthorized access to critical internal data structures, configuration details, or complete access to all data repositories reachable by the Helidon instance, thereby violating confidentiality boundaries."
}