Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-18T21:18:25.430Z",
  "pubdate": "2026-08-18T21:18:25.430Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Imperative Web Server component of the Oracle Fusion Middleware Helidon product, specifically affecting version 1.4.19. This security flaw permits unauthenticated malicious actors with network access via the HTTP protocol to compromise the targeted Helidon instance remotely without requiring user interaction.\nSuccessful exploitation of this vulnerability yields severe security implications regarding data governance, granting unauthorized actors complete access capabilities. Specifically, attackers can achieve unauthorized creation, deletion, or modification of critical data as well as all data accessible by Helidon, alongside unauthorized read access to critical and completely accessible Helidon data.\nThe severity of this issue is reflected in its CVSS 3.1 Base Score of 9.1, carrying high impact metrics for both confidentiality and integrity, while availability remains unaffected. The attack vector is purely network-based with low attack complexity, requiring no prior privileges or user interaction, thereby representing a critical risk posture for deployed environments utilizing the affected version.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 1.4.19. The root cause stems from inadequate request handling, input validation, or access control enforcement within the HTTP processing pipeline of the web server implementation, allowing malicious payloads to bypass intended security boundaries.\nExploitation is conducted remotely over the network via the HTTP protocol. Because the vulnerability requires no authentication and no user interaction, an unauthenticated attacker can directly interact with the exposed HTTP endpoints of the vulnerable Helidon component to initiate the attack sequence.\nThe attack flow proceeds as follows: First, the remote attacker crafts an HTTP request designed to exploit the processing flaw within the Imperative Web Server. Second, the attacker transmits this network payload across the HTTP protocol to the target Helidon instance. Third, due to the absence of sufficient authentication and access controls, the vulnerable component improperly processes the request, granting the attacker unauthorized execution context.\nPost-exploitation impact includes severe compromise of data security principles. The attacker gains the capability to perform unauthorized data manipulation—specifically the creation, deletion, and modification of critical or entirely Helidon-accessible data. Furthermore, the attacker achieves complete unauthorized read access to critical data. The attack vector is strictly network-based (AV:N), with low attack complexity (AC:L), requiring no privileges (PR:N) and no user interaction (UI:N), while maintaining a scope of unchanged (S:U)."
}