Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-18T21:18:21.983Z",
  "pubdate": "2026-08-18T21:18:21.983Z",
  "executiveSummary": "An easily exploitable security vulnerability has been identified within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This flaw allows unauthenticated remote attackers with network access via HTTP to compromise the affected application. Successful exploitation of this vulnerability has significant risk implications, granting unauthorized read, update, insert, and delete access to a subset of data accessible by Helidon. Furthermore, attackers can induce a partial denial of service (partial DOS) condition against the targeted Helidon service. The vulnerability carries a CVSS 3.1 Base Score of 7.3, reflecting the severity of its confidentiality, integrity, and availability impacts. Exploitation requires no privileges and no user interaction, lowering the barrier to entry for malicious actors targeting exposed network services.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Helidon version 4.5.0. The root cause stems from insufficient validation and access control enforcement within HTTP request processing routines handled by the web server. Attackers leverage network connectivity via the HTTP protocol to interact directly with the vulnerable component without requiring prior authentication or valid session credentials. The attack flow begins when an unauthenticated client transmits a specially crafted HTTP request payload to the network-exposed Helidon endpoint. Upon receipt, the Imperative Web Server fails to properly sanitize or restrict the input and associated actions, allowing the malicious payload to bypass authorization checks. This improper access control enforcement enables the execution of unauthorized operations against Helidon-accessible data stores and internal resources. In terms of post-exploitation impact, the successful processing of the payload permits unauthorized modification, insertion, and deletion of data, compromises data confidentiality through unauthorized read access to a subset of sensitive information, and strains system resources to trigger a partial denial of service (partial DOS). Because the vulnerability features an attack vector over the network (AV:N), low attack complexity (AC:L), requires zero privileges (PR:N), and demands no user interaction (UI:N), any exposed instance running the affected 4.5.0 version is immediately susceptible to remote exploitation."
}