Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 1.4.19. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T21:18:25.547Z",
  "pubdate": "2026-08-18T21:18:25.547Z",
  "executiveSummary": "An easily exploitable vulnerability affects the Oracle Fusion Middleware Helidon product, specifically within the Imperative Web Server component. The vulnerability impacts version 1.4.19 of the software.\nThis security flaw allows an unauthenticated remote attacker with network access via the HTTP protocol to compromise the Helidon instance.\nSuccessful exploitation of this vulnerability can result in unauthorized creation, deletion, or modification access to critical data and all Helidon accessible data, as well as unauthorized read access to a subset of accessible data.\nThe severity of this issue is reflected in a CVSS 3.1 Base Score of 8.2, driven by significant impacts on confidentiality and integrity.\nThe attack vector is network-based, with low attack complexity, requiring no privileges and no user interaction, making it a high-risk exposure for deployed environments running the affected version.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Helidon version 1.4.19.\nThe attack vector is network-based (AV:N), allowing remote threat actors to interact directly with the vulnerable HTTP service without requiring prior authentication (PR:N) or user interaction (UI:N).\nThe attack complexity is rated as low (AC:L), indicating that exploitation does not require specialized conditions or advanced circumvention techniques.\nDuring an attack, an unauthenticated malicious actor sends specially crafted HTTP requests to the exposed Helidon Imperative Web Server interface.\nDue to insufficient validation or improper access controls within the vulnerable component, the application fails to properly restrict request handling and data operations.\nThis permits the execution of unauthorized data manipulation operations, leading to compromised integrity via unauthorized creation, deletion, or modification of critical and accessible data.\nAdditionally, the flaw permits unauthorized read access to a subset of Helidon accessible data, impacting confidentiality (C:L, I:H, A:N).\nThe scope remains unchanged (S:U), as the vulnerability is contained within the affected Helidon component context."
}