Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:23.000Z",
  "pubdate": "2026-08-18T21:18:23.000Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component. The vulnerability affects the supported version 4.5.1 of the software. This security flaw enables an unauthenticated remote attacker with network access via the HTTP protocol to compromise the affected Helidon instance. Successful exploitation of this vulnerability directly impacts data integrity, allowing unauthorized actors to perform critical data operations such as the unauthorized creation, deletion, or modification of accessible data within the Helidon ecosystem. The vulnerability carries a CVSS 3.1 Base Score of 7.5, reflecting its high severity regarding integrity impacts, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The risk implications are substantial for organizations deploying the affected version, as it removes authentication and authorization barriers for data-mutating operations over the network. Exploitation requires no user interaction and low attack complexity, making it an attractive vector for malicious actors seeking to corrupt, insert, or destroy critical application data without prior system access or credentials.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Helidon version 4.5.1. The root cause stems from insufficient validation, access control enforcement, or improper request handling within the web server architecture, which fails to properly verify whether an incoming HTTP request from an unauthenticated source is authorized to execute state-changing or data-mutating operations. The attack vector is strictly network-based, utilizing the HTTP protocol to interact with exposed endpoints managed by the vulnerable Imperative Web Server. Because the vulnerability is characterized by a low attack complexity (AC:L), requires no privileges (PR:N), and demands zero user interaction (UI:N), an attacker can reliably construct and transmit malicious HTTP payloads directly to the target service without requiring prior reconnaissance or valid user credentials. The attack flow begins when the unauthenticated threat actor sends a crafted HTTP request targeting vulnerable routines within the Imperative Web Server component. Upon receipt, the affected component processes the request without enforcing appropriate authentication or integrity checks. This failure allows the malicious payload to bypass security boundaries and interact directly with backend data handlers or storage mechanisms managed by Helidon. Consequently, the execution of the request results in unauthorized data manipulation, specifically manifesting as unauthorized creation, deletion, or modification of critical application data or any data accessible to the Helidon runtime. The post-exploitation impact is strictly confined to integrity compromise (I:H) with no direct confidentiality (C:N) or availability (A:N) impacts indicated by the CVSS vector, meaning that while data theft or denial of service may not occur via this specific vector, the trustworthiness, accuracy, and completeness of the application data are entirely compromised."
}