Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.20. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-18T21:18:25.317Z",
  "pubdate": "2026-08-18T21:18:25.317Z",
  "executiveSummary": "An unauthenticated vulnerability exists within the Helidon product of Oracle Fusion Middleware, specifically affecting the Imperative Web Server component in version 1.4.20. This security flaw is classified as difficult to exploit and can be leveraged by an unauthenticated attacker over the network via HTTP requests. Successful exploitation of this vulnerability compromises the integrity of the targeted system, allowing unauthorized modification, insertion, or deletion of data accessible to Helidon. The vulnerability carries a CVSS 3.1 Base Score of 3.7 with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating that while confidentiality and availability remain unaffected, integrity impacts are present under specific high-complexity attack conditions.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Helidon product within Oracle Fusion Middleware version 1.4.20. The flaw allows network-based adversaries to interact with the web server via the HTTP protocol to bypass intended access controls or data validation checks. The root cause stems from insufficient validation or enforcement of authorization boundaries within the request processing logic of the Imperative Web Server. Because the attack vector is network-based (AV:N), external actors can transmit malicious HTTP payloads directly to the listening service without requiring prior authentication (PR:N) or user interaction (UI:N). However, the attack complexity is rated as high (AC:H), implying that successful exploitation requires specific timing, precise payload construction, or non-default environmental conditions to circumvent existing security checks. The scope of the vulnerability is unchanged (S:U), meaning the impact is constrained to the vulnerable Helidon component itself. Upon successful execution of the attack flow, the adversary can induce unauthorized state changes within the application data layer. This payload behavior specifically results in integrity violations, manifesting as unauthorized update, insert, or delete operations against accessible Helidon data stores or application data structures, while leaving system confidentiality and availability uncompromised."
}