Description

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-18T21:18:27.023Z",
  "pubdate": "2026-08-18T21:18:27.023Z",
  "executiveSummary": "An easily exploitable vulnerability affects the Imperative Web Server component of the Oracle Fusion Middleware product, specifically within Helidon version 3.2.20.\nThe vulnerability allows an unauthenticated remote attacker with network access via HTTP to compromise the affected system, resulting in a significant scope change.\nSuccessful exploitation of this flaw can lead to unauthorized creation, deletion, or modification access to critical data or all data accessible by Helidon.\nThe vulnerability carries a CVSS 3.1 Base Score of 8.6 with a vector of (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N), highlighting severe integrity impacts while confidentiality and availability remain unaffected.\nDue to the low attack complexity, lack of required privileges or user interaction, and remote network vector, the risk implication is high, potentially impacting additional products beyond Helidon due to the scope change.",
  "technicalDetails": "The vulnerability resides within the Imperative Web Server component of Oracle Fusion Middleware Helidon version 3.2.20.\nThe attack vector is network-based via HTTP, allowing remote unauthenticated adversaries to interact directly with the vulnerable component without requiring any prior authentication or user interaction.\nThe attack complexity is rated as low, indicating that exploitation does not require specialized conditions or complex race conditions.\nThe exploitation flow begins when an attacker sends a maliciously crafted HTTP request over the network to the Helidon Imperative Web Server.\nDue to insufficient validation or improper access controls within the affected component, the request bypasses security checks.\nThe request triggers a scope change (S:C), allowing the attack context to extend beyond the immediate boundaries of Helidon and potentially impact additional integrated or downstream products.\nUpon successful processing of the payload, the attacker achieves unauthorized data manipulation capabilities.\nThe post-exploitation impact is strictly concentrated on integrity (I:H), granting the adversary the ability to perform unauthorized creation, modification, or deletion of critical data or any data accessible through the Helidon runtime.\nConfidentiality and availability impacts are rated as none (C:N, A:N), meaning data exfiltration and denial of service are not direct outcomes of this specific vulnerability vector."
}