Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:18:25.200Z",
  "pubdate": "2026-08-18T21:18:25.200Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting version 1.4.19. This security flaw enables unauthenticated malicious actors with network access to compromise the targeted Helidon instance via the HTTP protocol.\nSuccessful exploitation of this vulnerability grants unauthorized actors extensive capabilities, including the creation, deletion, and modification of critical data or all data accessible to Helidon. Furthermore, it allows unauthorized read access to critical or completely accessible Helidon data, severely compromising data confidentiality and integrity while leaving availability unaffected.\nWith a CVSS 3.1 Base Score of 9.1 and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, the vulnerability underscores a severe risk profile. The attack vector is network-based (AV:N), attack complexity is low (AC:L), privileges required are none (PR:N), user interaction is not required (UI:N), and the scope is unchanged (S:U).\nGiven the lack of required authentication and privileges, organizations running the affected version face significant exposure to data tampering and exfiltration attacks, necessitating immediate remediation actions.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of Oracle Fusion Middleware Helidon version 1.4.19. The root cause stems from insufficient access controls or improper input/request handling within the HTTP request processing pipeline of the affected server component.\nExploitation is conducted via the network layer using the HTTP protocol. Because the vulnerability requires no authentication (PR:N) and no user interaction (UI:N), an unauthenticated attacker can directly interact with the exposed Helidon service over the network with low attack complexity (AC:L).\nThe attack flow proceeds as follows: First, the attacker identifies a network-accessible endpoint running the vulnerable Helidon 1.4.19 Imperative Web Server. Second, the attacker crafts malicious HTTP requests designed to bypass intended security boundaries within the request handling logic. Third, by transmitting these specially crafted HTTP payloads, the attacker forces the vulnerable component to process unauthorized operations.\nUpon successful execution of the payload, the post-exploitation impact allows the adversary to interact with underlying data layers managed or accessible by Helidon. This results in unauthorized modification, creation, and deletion of critical datasets (impacting data integrity), as well as unauthorized retrieval of sensitive information (impacting data confidentiality).\nThe scope of the vulnerability remains unchanged (S:U), meaning the security impact is strictly confined to the resources accessible within the immediate context of the vulnerable Helidon component without directly escalating to the underlying host operating system, though the data exposure itself remains critical."
}