Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-18T21:18:21.650Z",
  "pubdate": "2026-08-18T21:18:21.650Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This network-accessible flaw allows unauthenticated remote attackers to compromise the application via HTTP requests without requiring user interaction.\nSuccessful exploitation of this security defect grants unauthorized actors the capability to perform insert, update, and delete operations on accessible data, achieve unauthorized read access to a subset of sensitive data, and induce a partial denial of service (partial DoS) condition affecting Helidon availability.\nWith a CVSS 3.1 Base Score of 7.3 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, the vulnerability presents significant risk across confidentiality, integrity, and availability vectors. The low attack complexity and absence of authentication or privilege requirements make this issue critical for organizations deploying the affected Helidon version.\nMitigation requires applying vendor-supplied updates or patches corresponding to the affected component to remediate the underlying logic or input validation flaws that permit unauthorized data manipulation and service degradation.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This component is responsible for handling incoming HTTP requests and routing them through the application infrastructure. The root cause stems from insufficient validation, authorization enforcement, or improper request handling logic within the web server subsystem, which fails to adequately restrict request processing for unauthenticated entities.\nExploitation is conducted entirely over the network via standard HTTP protocols. Because the vulnerability requires low attack complexity (AC:L), no prior authentication (PR:N), and no user interaction (UI:N), an external attacker can directly target the exposed HTTP endpoints of the Helidon server. The attacker crafts malicious HTTP requests designed to bypass intended access controls or trigger resource-intensive or improperly bounded logic within the Imperative Web Server.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies a network-exposed Helidon 4.5.0 instance. Second, the attacker transmits specifically crafted HTTP payloads to vulnerable endpoints handled by the Imperative Web Server. Third, due to the lack of stringent security checks, the server processes the input, allowing the attacker to execute unauthorized read operations against a subset of accessible data, execute unauthorized data modifications (inserts, updates, deletes), or exhaust server resources to induce a partial denial of service (partial DoS).\nPost-exploitation impacts include the degradation of system availability, unauthorized disclosure of sensitive information subsets, and integrity violations through unauthorized data tampering. The scope (S:U) remains unchanged, meaning the impact is limited to the vulnerable Helidon component and its directly accessible data stores without inherently compromising the underlying host operating system, unless secondary system vulnerabilities exist."
}