Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 9.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-18T21:18:24.967Z",
  "pubdate": "2026-08-18T21:18:24.967Z",
  "executiveSummary": "An easily exploitable vulnerability affects the Imperative Web Server component of Oracle Helidon version 4.5.0, part of Oracle Fusion Middleware. This critical security flaw allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the affected Helidon instance completely.\nSuccessful exploitation of this vulnerability has severe security implications across all three pillars of the CIA triad. An attacker can achieve unauthorized creation, deletion, and modification of critical data or all data accessible to Helidon. Additionally, the vulnerability grants unauthorized access to critical or complete data sets and enables the attacker to trigger a partial denial of service (partial DoS) against the application.\nThe vulnerability carries a CVSS 3.1 Base Score of 9.4 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. The high severity stems from the complete lack of required authentication or user interaction combined with low attack complexity over a network vector. Organizations utilizing the affected version face significant exposure to data compromise and service degradation until remediation measures are applied.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Helidon version 4.5.0. As an architectural component responsible for handling incoming HTTP requests and routing them through the application stack, the Imperative Web Server fails to properly validate, sanitize, or authorize incoming requests before processing them.\nThe attack vector is network-based (AV:N), allowing remote threat actors to interact directly with the Helidon application layer via HTTP without requiring prior access to the internal network. The attack complexity is rated as low (AC:L), indicating that exploitation does not require specialized conditions, race conditions, or complex payload generation. Furthermore, the vulnerability requires zero privileges (PR:N) and zero user interaction (UI:N), meaning an unauthenticated external entity can issue malicious requests directly to the web server.\nThe attack flow begins when an unauthenticated attacker crafts a specialized HTTP request designed to exploit the input handling or access control flaws within the Imperative Web Server. Because the component lacks robust security boundaries at the ingress point, the crafted HTTP payload bypasses intended security checks. Upon processing the malicious request, the application executes unauthorized operations on behalf of the unauthenticated client.\nPost-exploitation impacts are extensive. In terms of confidentiality (C:H) and integrity (I:H), the vulnerability allows the attacker to read, modify, create, or delete critical or fully accessible Helidon data stores, configuration parameters, or underlying resources linked to the application context. Regarding availability (A:L), the payload execution can induce resource exhaustion, thread starvation, or application instability, culminating in a partial denial of service condition that degrades application responsiveness or availability for legitimate users."
}