Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:18:24.620Z",
  "pubdate": "2026-08-18T21:18:24.620Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This security flaw allows unauthenticated remote attackers with network access via HTTP to compromise the affected Helidon instance. Successful exploitation of this vulnerability can result in severe security consequences, specifically granting unauthorized create, delete, and modify access to critical data or all data accessible via Helidon, alongside unauthorized read access to critical or complete data sets.\nThe CVSS 3.1 base score is 9.1, highlighting critical impacts on confidentiality and integrity, though availability remains unaffected. The attack vector is network-based (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N) under a scope-unchanged (S:U) model. The high severity underscores significant risk exposure for organizations deploying the vulnerable Helidon version, necessitating immediate defensive evaluation and remediation actions to prevent unauthorized data manipulation and information disclosure.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Oracle Helidon product, specifically affecting version 4.5.0. The architecture of the Imperative Web Server fails to adequately validate or restrict incoming HTTP requests from unauthenticated network users, leading to a breakdown in access controls and authorization enforcement.\nThe attack flow begins when an unauthenticated remote adversary crafts and transmits malicious HTTP requests across the network to the exposed Helidon endpoint. Because the affected component does not require authentication or user interaction to process these requests, the payload is accepted and processed by the server.\nUpon successful ingestion and handling of the unauthorized HTTP traffic, the underlying vulnerability permits the attacker to bypass intended security boundaries. This grants the adversary arbitrary or unauthorized operational capabilities over the application data layer. Specifically, the attacker can execute unauthorized data modification, creation, and deletion routines, while simultaneously extracting sensitive information, leading to a total compromise of confidentiality and integrity for all Helidon-accessible data assets.\nThe technical prerequisites for exploitation are strictly network accessibility to the vulnerable HTTP service running on the Helidon 4.5.0 instance, combined with the absence of necessary authorization checks within the Imperative Web Server request handling pipeline. The vulnerability does not require any prior system privileges or interaction from legitimate users, facilitating automated or script-based exploitation at scale."
}