Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in takeover of Helidon. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T21:18:23.227Z",
  "pubdate": "2026-08-18T21:18:23.227Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of the Oracle Fusion Middleware product, specifically affecting Helidon version 4.5.0.\nThis vulnerability allows an unauthenticated remote attacker with network access via the HTTP protocol to fully compromise the target Helidon instance.\nSuccessful exploitation results in a complete system takeover, yielding critical impacts across confidentiality, integrity, and availability with a maximum CVSS 3.1 base score of 9.8.\nThe attack requires no privileges and no user interaction, making it highly critical for deployments utilizing the affected software version.\nThe risk implications include unauthorized access to sensitive data, modification of internal application state, and denial of service or complete application disruption.\nMitigation requires applying vendor-supplied updates or implementing strict network segmentation and access controls to restrict untrusted HTTP traffic to the vulnerable Imperative Web Server component.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Helidon version 4.5.0.\nThe root cause permits unauthenticated remote attackers to leverage network access via HTTP to execute unauthorized operations leading to application takeover.\nAttackers interact directly with the vulnerable HTTP service without requiring any prior authentication credentials or user interaction.\nThe attack flow begins with the adversary transmitting crafted HTTP requests over the network to the exposed Helidon Imperative Web Server.\nDue to insufficient validation or handling within the vulnerable component, the malicious payload is processed, resulting in arbitrary code execution or complete control over the runtime environment.\nPost-exploitation impact includes full system takeover, compromising all security pillars: confidentiality, integrity, and availability.\nNetwork exposure is direct, as the attack vector requires only standard network connectivity over the HTTP protocol to the target service."
}