Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-18T21:18:24.743Z",
  "pubdate": "2026-08-18T21:18:24.743Z",
  "executiveSummary": "An easily exploitable vulnerability affects the Imperative Web Server component of Oracle Fusion Middleware Helidon version 4.5.0. This network-based security flaw allows unauthenticated attackers with HTTP access to compromise the affected Helidon deployment.\nSuccessful exploitation of this vulnerability grants unauthorized actors the capability to perform insert, update, and delete operations on a subset of accessible data, read sensitive data, and trigger a partial denial of service (partial DOS) condition.\nThe vulnerability carries a CVSS 3.1 Base Score of 7.3, reflecting high severity across confidentiality, integrity, and availability metrics with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.\nBecause the attack vector is network-accessible and requires no privileges or user interaction, the risk implication is severe for organizations utilizing the vulnerable Helidon version without appropriate edge security or patching controls.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Helidon version 4.5.0. It exposes an attack surface accessible via standard HTTP communication protocols over the network.\nThe root cause stems from improper input validation, access control enforcement, or request handling logic within the web server implementation, allowing malicious payloads to bypass standard authorization boundaries.\nExploitation occurs without requiring prior authentication, user interaction, or elevated privileges. An unauthenticated remote attacker crafts specialized HTTP requests directed at the vulnerable Helidon web server endpoints.\nUpon transmitting the malicious HTTP payload across the network, the vulnerable component processes the request improperly, failing to adequately restrict unauthorized access to backend data structures and server resources.\nThe post-exploitation impact includes unauthorized data exposure (confidentiality compromise via read access), unauthorized data manipulation (integrity compromise via insert, update, and delete access), and resource exhaustion or service disruption (availability compromise resulting in partial denial of service).\nThe scope of the vulnerability is unchanged (S:U), indicating that the impact is bounded within the vulnerable Helidon application context rather than propagating across underlying hypervisors or host operating systems."
}