Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:26.913Z",
  "pubdate": "2026-08-18T21:18:26.913Z",
  "executiveSummary": "An easily exploitable vulnerability exists within the Helidon product of Oracle Fusion Middleware, specifically affecting the Imperative Web Server component in version 4.5.0. This security flaw enables unauthenticated threat actors with network access to compromise the targeted Helidon instance entirely via HTTP protocols. Successful exploitation of this vulnerability directly results in unauthorized access to critical data or complete access to all data accessible by Helidon, exclusively impacting data confidentiality with a CVSS 3.1 Base Score of 7.5. The associated CVSS vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The risk implications are severe for organizations deploying the affected version, as the vulnerability requires zero privileges, no user interaction, and low attack complexity over a network vector. Attackers can leverage this flaw remotely to bypass security controls and exfiltrate sensitive information without requiring prior authentication or specialized access credentials.",
  "technicalDetails": "The vulnerability resides in the Imperative Web Server component of the Helidon product, specifically impacting version 4.5.0. The root cause stems from insufficient access controls or improper validation handling within the HTTP request processing pipeline of the affected component, allowing unauthorized retrieval of restricted resources. Exploitation occurs remotely over the network via standard HTTP requests without requiring any pre-existing authentication credentials or user interaction. The attack flow begins when an unauthenticated attacker crafts a malicious HTTP request directed at the vulnerable Helidon endpoint exposed over the network. Due to the low attack complexity and absence of privilege requirements, the Imperative Web Server fails to properly enforce authorization checks before processing the request and returning the requested payload. Upon successful processing, the vulnerability permits the retrieval of sensitive system data, leading to unauthorized access to critical data or complete exposure of all data accessible within the Helidon runtime context. The post-exploitation impact is strictly confined to confidentiality breaches, wherein the attacker successfully reads and exfiltrates protected information without altering system integrity or causing a denial of service."
}