Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-18T21:18:25.890Z",
  "pubdate": "2026-08-18T21:18:25.890Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component. The vulnerability affects the supported version 4.5.3 and allows unauthenticated attackers with network access via HTTP to compromise the target system.\nSuccessful exploitation of this flaw can result in unauthorized update, insert, or delete access to a subset of Helidon accessible data, unauthorized read access to sensitive information, and the ability to cause a partial denial of service (partial DOS). Due to the architectural scope change (S:C), successful attacks may also significantly impact additional downstream or integrated products.\nThe vulnerability requires no privileges (PR:N) and no user interaction (UI:N), with low attack complexity (AC:L) over a network attack vector (AV:N). The CVSS 3.1 base score is rated at 8.3, reflecting severe impacts across confidentiality, integrity, and availability.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Oracle Helidon product, specifically impacting version 4.5.3.\nThe attack vector is network-based (AV:N), allowing unauthenticated remote threat actors to interact directly with the exposed HTTP service without requiring any prior authentication (PR:N) or user interaction (UI:N).\nThe attack flow proceeds as follows: an unauthenticated attacker crafts malicious HTTP requests directed at the vulnerable Imperative Web Server endpoint within Helidon. Due to insufficient input validation, access control enforcement, or request handling flaws within the component, the crafted requests bypass security boundaries.\nUpon successful processing of the malicious payload, the attacker achieves unauthorized read access to a subset of data accessible by Helidon, as well as unauthorized write, update, insertion, and deletion capabilities against targeted data structures.\nAdditionally, the payload execution can induce resource exhaustion or processing anomalies, resulting in a partial denial of service (partial DOS) condition that degrades the operational availability of the Helidon instance.\nThe security scope of the vulnerability is rated as changed (S:C), indicating that the compromise extends beyond the immediate boundaries of the Helidon component and poses significant risk impacts to additional integrated products or system contexts sharing trust relationships or interconnected services within the deployment architecture."
}