Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:23.573Z",
  "pubdate": "2026-08-18T21:18:23.573Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting version 4.5.0.\nThe vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the Helidon environment, leading to unauthorized access to critical data or complete access to all data accessible by Helidon.\nThe security flaw carries a CVSS 3.1 Base Score of 7.5, with impacts strictly limited to confidentiality, resulting in a CVSS vector of (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\nGiven that the attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N), the risk implication is significant for exposed deployments.\nOrganizations running the affected version face severe data exposure risks if proper network controls or software updates are not applied.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0.\nExploitation of this flaw is achievable over the network via HTTP without requiring any prior authentication or user interaction.\nThe attack flow begins when an unauthenticated attacker sends a maliciously crafted HTTP request targeting the exposed network service of the vulnerable Helidon instance.\nDue to insufficient access controls or validation mechanisms within the vulnerable component, the request bypasses security boundaries and successfully retrieves sensitive information.\nThe root cause permits unauthorized read access to internal resources and data repositories accessible to the Helidon runtime.\nThe payload behavior focuses on extracting high-value data, resulting in a direct impact on data confidentiality.\nPost-exploitation impact includes unauthorized access to critical data or complete access to all data accessible through the Helidon application.\nThe scope remains unchanged (S:U), but the confidentiality impact is rated as high (C:H) with no integrity (I:N) or availability (A:N) disruption."
}