Helidon
Monthly
Unauthenticated remote exploitation of Oracle Helidon 3.2.20's Imperative Web Server component enables attackers to perform unauthorized creation, deletion, or modification of critical data via HTTP with no prerequisites. The vulnerability carries a scope change (S:C in CVSS), meaning successful exploitation can cascade to impact additional products or systems beyond Helidon itself. Tagged as an authentication bypass, this is classified by Oracle as easily exploitable with no public exploit identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0 exposes all data reachable through the Imperative Web Server component to unauthenticated remote attackers over HTTP. Tagged as an authentication bypass, the flaw allows complete confidentiality compromise - an attacker can read critical or all accessible application data without supplying credentials. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially executable from any network position.
Remote denial-of-service and partial data exposure in Oracle Helidon 4.5.0 allows unauthenticated network attackers via HTTP/2 to cause a complete hang or crash of the Helidon Imperative Web Server, alongside unauthorized read access to a subset of accessible data. The vulnerability is classified as easily exploitable with no authentication, user interaction, or special configuration required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a realistic denial-of-service threat against any exposed Helidon 4.5.0 deployment.
Remote denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network attackers to hang or repeatedly crash the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, zero-prerequisite exploitation against any reachable instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a credible threat to internet-facing deployments.
Denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to crash or indefinitely hang the service via crafted HTTP/2 traffic. Disclosed as part of Oracle's Critical Security Patch Update (CPU) for August 2026, the vulnerability is rated CVSS 7.5 with low attack complexity and no privileges required, making automated exploitation straightforward against any exposed instance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Partial denial of service in Oracle Helidon 4.5.3 is reachable by unauthenticated network attackers over HTTP, targeting the Imperative Web Server component within Oracle Fusion Middleware. Successful exploitation degrades availability without compromising confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects a bounded, availability-only impact.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows network attackers over HTTP to achieve partial confidentiality disclosure, data manipulation, and denial of service - with a confirmed scope change indicating the impact can extend to components beyond Helidon's own security boundary. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) places this among the most easily reachable vulnerability classes: no credentials, no user interaction, and no elevated complexity required. Disclosed in Oracle's August 2026 Critical Security Patch Update, no public exploit code or CISA KEV listing has been identified at time of analysis.
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attacker send HTTP requests that grant high-integrity write access to Helidon-accessible data, partial read disclosure, and a partial denial of service - with impact that can extend beyond Helidon into adjacent products. Rated CVSS 3.1 9.9 due to the scope change combined with easy, no-privilege network exploitation. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows remote attackers to partially compromise confidentiality, integrity, and availability of the affected system, with a confirmed scope change meaning attacks can extend impact to additional co-located products or services. The vulnerability is rated 8.3 (High) under CVSS 3.1, elevated by the scope change despite individually low CIA impact ratings. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers to bypass authentication controls via HTTP, resulting in unauthorized read access to a subset of application data and the ability to insert, update, or delete accessible records. The CVSS scope change (S:C) indicates successful exploitation can affect additional systems beyond the Helidon instance itself - a compounding factor in microservices topologies where Helidon acts as a gateway or intermediary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated, low-complexity attack path makes this credible against any internet-exposed deployment.
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
Unauthenticated remote exploitation of Oracle Helidon 1.4.19's Imperative Web Server component via HTTP allows attackers to perform unauthorized creation, deletion, and modification of critical application data, with partial read access to Helidon-accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero barriers to exploitation - no credentials, no user interaction, and low attack complexity over standard HTTP. Reported via Oracle's Critical Patch Update for August 2026 and tagged as an Authentication Bypass, with no public exploit code or CISA KEV listing identified at time of analysis.
Authentication bypass in Oracle Helidon 1.4.19 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote, unauthenticated attacker reach and manipulate protected data over HTTP, yielding full read and write access to all data the Helidon instance can reach. Oracle rates it CVSS 9.1 with High confidentiality and integrity impact and no availability impact, and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Integrity compromise in Oracle Helidon 1.4.20's Imperative Web Server component enables unauthenticated remote attackers to perform limited unauthorized data modifications via HTTP under high-complexity conditions. The vulnerability, tagged as an authentication bypass, allows circumvention of access controls to execute unauthorized update, insert, or delete operations on Helidon-accessible data without requiring credentials or user interaction. No public exploit code has been identified and no active exploitation is confirmed; the CVSS 3.7 Low score combined with high attack complexity (AC:H) significantly constrain real-world risk.
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach critical data and disrupt service over plain HTTP with no credentials and no user interaction. Oracle rates it CVSS 3.1 9.4, reflecting high confidentiality and integrity impact plus partial denial of service, and it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make it a top-tier patch priority.
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to partially compromise confidentiality, integrity, and availability via standard HTTP. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms zero authentication or user interaction is required, and attack complexity is low - meaning successful exploitation demands minimal attacker skill or infrastructure. Disclosed through Oracle's Critical Patch Update for August 2026, no public exploit code has been identified at time of analysis, though the low-barrier network vector warrants prompt remediation for any internet-exposed Helidon deployment.
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) allows a network attacker to read, create, modify, or delete all data accessible to the framework over HTTP. Tagged by Oracle as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it as easily exploitable, warranting prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows attackers with HTTP network access to read a subset of application-accessible data and trigger partial denial of service conditions. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L vector confirms low-complexity, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; this issue was disclosed through Oracle's Critical Security Patch Update for August 2026 (EUVD-2026-62158).
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an Authentication Bypass by Oracle Security, the flaw is rated Medium (CVSS 5.4) with low attack complexity, meaning any attacker holding even minimal credentials can trivially exploit it without user interaction. No public exploit code or CISA KEV listing is associated at time of analysis, though the straightforward exploitation conditions make this a credible threat in multi-tenant or shared-access Helidon deployments.
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server component over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw yields full compromise of confidentiality, integrity, and availability (CVSS 9.8) without credentials or user interaction. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Unauthorized data access and manipulation in Oracle Helidon 4.5.0's Imperative Web Server allows low-privileged network attackers to read restricted data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables authenticated users to exceed their intended authorization scope within the Helidon application. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though Oracle's August 2026 Critical Patch Update confirms the issue.
Unauthorized read access to data in Oracle Helidon 4.5.1's Imperative Web Server component is achievable by unauthenticated network attackers via HTTP, exploiting what the vendor tags as an authentication bypass condition. The affected version is precisely 4.5.1 of Oracle's Java microservices framework, and the vulnerability exposes a subset of data accessible to the server without requiring any credentials or user interaction. No public exploit has been identified at time of analysis, and Oracle has disclosed this issue as part of its August 2026 Critical Patch Update.
Authentication bypass in Oracle Helidon 3.2.19 Imperative Web Server exposes critical data to unauthenticated network attackers via HTTP. The flaw, tagged as an Authentication Bypass by the reporter, allows a remote attacker without credentials to gain complete read access to all data accessible by the Helidon server instance. No public exploit code or active exploitation has been identified at time of analysis; however, the high confidentiality impact warrants timely patching in any environment running this specific version.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated, network-adjacent attackers to read critical application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial exploitability with no authentication or user interaction required. Classified under the Authentication Bypass tag by Oracle, this vulnerability is covered in the Oracle Critical Patch Update for August 2026, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to access critical or all Helidon-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required (PR:N/UI:N) and a high confidentiality impact. Disclosed as part of Oracle's Critical Patch Update for August 2026, no public exploit or CISA KEV listing has been identified at time of analysis.
The Imperative Web Server in Oracle Helidon 4.5.0 exposes an authentication bypass that permits remote unauthenticated HTTP attackers to read a subset of application-accessible data. Tagged by Oracle CSIRT as an authentication bypass and disclosed in the August 2026 Critical Patch Update, the flaw carries a CVSS 5.3 Medium score with network-accessible, zero-complexity exploitation conditions - conditions that may understate practical risk given the complete absence of authentication prerequisites. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified at time of analysis.
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data access and modification is possible in Oracle Helidon 4.5.1 via a flaw in its Imperative Web Server component, classified under the Authentication Bypass tag. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can exploit this over HTTP with no user interaction and low attack complexity. Successful exploitation results in partial confidentiality and integrity compromise of Helidon-accessible data; no patch version has been independently confirmed beyond the Oracle August 2026 CPU advisory.
Authentication bypass in Oracle Helidon 4.5.1 (Imperative Web Server component) exposes applications to unauthenticated remote attackers who can create, modify, or delete critical data accessible to the service via standard HTTP requests. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 7.5, reflecting a network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Unauthorized data access in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network-based attackers to read a subset of Helidon-accessible data and perform unauthorized insert, update, or delete operations against the same data store. The 'Authentication Bypass' tag in the intelligence feeds indicates the underlying mechanism circumvents expected access controls on HTTP endpoints. With AC:H, exploitation is non-trivial - specific conditions must be met - and no active exploitation has been identified; however, the unauthenticated network vector warrants patching in production deployments.
Unauthorized read access to application data is achievable against Oracle Helidon 4.5.1's Imperative Web Server component via unauthenticated HTTP requests. The vulnerability, tagged as an Authentication Bypass, allows remote attackers with network access to retrieve a subset of data without credentials, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit has been identified at time of analysis, and the issue is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data read in Oracle Helidon 3.2.19's Imperative Web Server component allows unauthenticated remote attackers to access a subset of protected application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no credentials or user interaction required, consistent with the intelligence tag of Authentication Bypass. Impact is bounded to confidentiality only (C:L, I:N, A:N), suggesting an access control bypass that exposes a partial data view rather than full system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle Helidon 4.5.0's Imperative Web Server component enables unauthenticated, network-accessible attacks that produce partial confidentiality and integrity impacts while extending harm to additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical fingerprint of reflected or stored XSS - an attacker delivers a crafted HTTP payload that, once interacted with by a victim user, executes within a different security scope such as a browser session. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; Oracle disclosed it through the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.1.0's Imperative Web Server component allows network-accessible attackers to bypass authentication controls via HTTP, resulting in unauthorized partial read and write access to application data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no prerequisites beyond network reachability, and the 'Authentication Bypass' tag corroborates an access-control failure in the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and zero-authentication requirement make this an attractive target for automated scanning.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality and availability degradation rather than full system compromise.
Unauthorized data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data via HTTP. Tagged as an authentication bypass, the vulnerability is trivially exploitable with no complexity barriers - any attacker with HTTP access to the service can trigger it. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and impact is constrained to partial confidentiality loss with no integrity or availability consequences.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to bypass authentication and perform unauthorized read and write operations on application data over HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team, this vulnerability exposes a subset of Helidon-accessible data to disclosure and tampering without requiring credentials or user interaction. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the low attack complexity and zero-privilege requirement make it a straightforward target for automated scanning.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability, tagged as an Authentication Bypass by Oracle, is remotely exploitable without credentials or user interaction against the affected version. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and absence of authentication requirements make this straightforward to exploit once a target instance is identified.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to read a subset of accessible data, perform unauthorized write/modify operations, and cause a partial denial of service. The CVSS vector confirms network accessibility with no authentication, no user interaction, and low attack complexity, making this easily exploitable against exposed deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions warrant prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to crash or indefinitely hang the server by sending crafted HTTP/2 traffic. The vulnerability carries a CVSS 7.5 rating with low attack complexity and no credential or interaction requirement, making it trivially scriptable from any network-accessible position. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, meaning protections that should gate read access can be circumvented without credentials. No public exploit code has been identified at time of analysis, and it has not been listed in the CISA KEV catalog, though Oracle disclosed this via their August 2026 Critical Patch Update (CPU).
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server enables unauthenticated remote attackers to read a subset of application-accessible data via HTTP, confirmed by Oracle's August 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-complexity network access requiring no authentication or user interaction. No public exploit has been identified at time of analysis, though the 'Authentication Bypass' tag from multi-source intelligence indicates a structural access control failure in the HTTP request handling pipeline.
Unauthenticated remote access to sensitive data affects Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2, allowing an attacker with network access to read critical or all data accessible to the Helidon application. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required. No public exploit identified at time of analysis, and the flaw is disclosed through Oracle's Critical Patch Update for August 2026.
Unauthenticated remote exploitation of the Imperative Web Server component in Oracle Helidon 4.5.0 allows network-accessible attackers to perform unauthorized read and write operations against application-accessible data, with confirmed scope change indicating downstream impact on adjacent systems beyond the directly targeted Helidon instance. The vulnerability is tagged as an authentication bypass, meaning the HTTP-exposed service fails to enforce access controls on one or more endpoints. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though Oracle's Critical Patch Update advisory for August 2026 confirms the vulnerability's existence and assigns a CVSS 3.1 score of 7.2.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server allows remote unauthenticated attackers to read a subset of application data and make unauthorized modifications via HTTP, with a scope change indicating potential cascade impact to downstream services. The CVSS 3.1 score of 7.2 (High) is elevated by the scope change (S:C), reflecting Helidon's common role as a gateway or orchestrator in microservices architectures. No public exploit or CISA KEV listing has been identified at time of analysis, but the fully unauthenticated, low-complexity, network-accessible attack profile makes this a credible and time-sensitive patching priority for any internet-exposed deployment.
Unauthenticated information disclosure in Oracle Helidon 4.5.0's Imperative Web Server component exposes complete application data to remote network attackers via HTTP. Tagged as an authentication bypass, the flaw allows any unauthenticated actor with network access to read critical or all Helidon-accessible data without any privileges or user interaction. No patch version has been independently confirmed beyond the Oracle CPU August 2026 advisory, and no active exploitation has been identified at time of analysis.
Unauthenticated confidentiality breach in Oracle Helidon 3.2.18's Imperative Web Server component exposes all accessible data to remote attackers over HTTP. Tagged as an authentication bypass, this flaw requires no credentials, no user interaction, and no special network positioning - any attacker with HTTP access to a vulnerable instance can read critical application data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit opportunistically.
Denial-of-service in Oracle Helidon 3.2.19's Imperative Web Server component allows remote unauthenticated attackers to cause a complete hang or repeatable crash via HTTP, fully disrupting service availability. The vulnerability requires no authentication, no user interaction, and no special configuration, making it trivially exploitable against any network-accessible Helidon 3.2.19 instance. No public exploit code has been identified and it does not appear in CISA KEV at time of analysis, though the low attack complexity elevates operational risk for any exposed deployment.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-adjacent attacker to read unauthorized data subsets and perform unauthorized insert, update, or delete operations via HTTP. Rated CVSS 5.4 Medium with low attack complexity and no user interaction required, this flaw is tagged as an authentication bypass by multi-source intelligence, suggesting a low-privileged user can exceed their authorized scope within the Helidon web layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local high-privilege information disclosure in Oracle Helidon 4.5.1's Imperative Web Server component allows an attacker with OS-level logon access to the hosting infrastructure to read all data accessible to the Helidon process. The CVSS vector (AV:L/AC:L/PR:H) confirms exploitation is constrained to local infrastructure access with elevated credentials, resulting in complete confidentiality loss (C:H) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can create, delete, or modify critical data in Oracle Helidon 4.5.1 by bypassing authentication controls in the Imperative Web Server component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network reachability with no credentials, no user interaction, and no elevated access - placing this firmly in the easily exploitable category per Oracle's own classification. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity warrants prompt patching for any internet-exposed Helidon deployments.
Unauthenticated remote data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows network attackers to bypass authentication and gain complete access to data served by the application via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, user interaction, or special access are required, and Oracle's own advisory characterizes the vulnerability as 'easily exploitable.' No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the authentication bypass nature paired with a High confidentiality impact warrants prompt remediation.
Authentication bypass in Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to read a subset of data accessible within the Helidon service over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable from any network location against default deployments without credentials. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequence, though the 'Authentication Bypass' tag suggests access-control logic failures that may expose protected endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability carries a scope-change designation (S:C in CVSS), meaning successful exploitation may cascade beyond Helidon itself to impact additional products or services in the surrounding microservices environment. No public exploit code or active exploitation has been confirmed at time of analysis, but the zero-prerequisite attack profile - no authentication, low complexity, no user interaction - makes this straightforward to exploit once the bypass mechanism is understood.
Unauthenticated network exploitation of Oracle Helidon 3.2.19's Imperative Web Server component allows remote attackers to bypass authentication over HTTP, gaining unauthorized read access to a subset of data and the ability to insert, update, or delete accessible data. The CVSS S:C scope change is particularly significant: in microservices environments where Helidon acts as a service layer, successful exploitation may cascade to impact downstream or co-located systems beyond the initially compromised component. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the zero-prerequisites attack profile (AV:N/AC:L/PR:N/UI:N) and scope change make this a prioritized patching target for any organization running the affected version.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-authenticated attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that existing access controls within the Imperative Web Server can be circumvented by an attacker who holds any valid low-privilege credential. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized write, insert, or delete operations. Exploitation via HTTP requires high attack complexity and at least low-level authentication, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Helidon 4.5.0 affects the Imperative Web Server component, enabling unauthenticated network attackers to read a subset of accessible application data via HTTP. Tagged as an authentication bypass, the flaw requires no privileges or user interaction, making it trivially reachable from any network vantage point. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though its zero-authentication, low-complexity profile warrants timely patching in network-exposed deployments.
Unauthorized data read in Oracle Helidon 3.2.18 allows unauthenticated remote attackers to access a subset of data served by the Imperative Web Server component over HTTP, with no credentials or user interaction required. Tagged as an Authentication Bypass by Oracle CERT, the flaw is classified as 'easily exploitable' in Oracle's August 2026 Critical Patch Update advisory. No public exploit code or active exploitation has been identified at time of analysis, but the absence of any authentication prerequisite lowers the bar for opportunistic reconnaissance.
Cross-site scripting or authentication bypass in Oracle Helidon 4.1 Imperative Web Server (version 4.5.0) allows unauthenticated remote attackers to perform unauthorized read and write operations against Helidon-accessible data, with scope change extending impact to additional dependent products. Exploitation requires victim interaction, consistent with a reflected XSS or similar client-side injection pattern in the HTTP server component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers once a victim is lured.
Cross-site scripting or equivalent client-side injection in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to compromise confidentiality and integrity of Helidon-accessible data when a victim user interacts with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a canonical XSS fingerprint - scope change combined with user interaction and partial C/I impact - despite the 'Authentication Bypass' tag in the intelligence metadata, which may indicate a secondary or misclassified characteristic. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component exposes HTTP endpoints to unauthenticated network attackers, enabling unauthorized read access to a subset of application data and unauthorized write, insert, or delete operations on accessible data. The flaw, tagged as an Authentication Bypass by Oracle and reported via the August 2026 Critical Patch Update, is reachable by any attacker with HTTP connectivity to the service with no complexity barriers. No public exploit code has been identified and the vulnerability is not currently listed in CISA KEV, but the zero-authentication network attack vector warrants prompt patching of affected Helidon 4.5.0 deployments.
Unauthenticated network exploitation of Oracle Helidon 3.2.18's Imperative Web Server component allows remote attackers to bypass authentication controls, gaining unauthorized read access to a subset of application data and unauthorized write/insert/delete capability against some accessible data. Tagged as an authentication bypass by Oracle Security (secalert_us@oracle.com), the vulnerability requires no privileges and no user interaction, making it trivially automatable over HTTP. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has disclosed this via their August 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle Helidon 4.5.0 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote attacker reach and manipulate all data accessible to the framework over HTTP. Tagged as an authentication bypass, it carries a CVSS 9.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to read, create, modify, or delete any data the application can access. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it is trivially exploitable over the network with no user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middleware) lets a network attacker read, create, delete or modify all Helidon-accessible data and cause a partial denial of service, all over HTTP without credentials. Oracle rates this CVSS 9.4 and tags it as an authentication bypass, meaning attackers reach protected functionality without logging in. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read, alter, or destroy all data the framework can access and degrade its availability. The flaw is remotely reachable over HTTP with no authentication or user interaction and carries a CVSS 3.1 base score of 9.4. It was disclosed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access in Oracle Helidon 3.2.18 (Imperative Web Server component) allows a low-privileged, network-adjacent attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables privilege escalation beyond the attacker's authorized scope within the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the affected instance. Oracle rates the flaw CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as "easily exploitable," fixed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component exposes sensitive application data to unauthenticated network attackers over HTTP. Successful exploitation yields complete read access to all Helidon-accessible data and limited write capability (insert, update, delete), with no availability impact. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the high attack complexity rating tempers immediate mass-exploitation risk, though the confidentiality impact warrants prompt patching for internet-exposed deployments.
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Full instance takeover of Oracle Helidon 3.2.18 (Imperative Web Server component) is achievable by a low-privileged remote attacker over HTTP, though exploitation demands high attack complexity. The CVSS 3.1 score of 7.5 reflects complete confidentiality, integrity, and availability compromise - consistent with the vendor description of 'takeover' - affecting Oracle Fusion Middleware deployments running this specific release. No public exploit code or CISA KEV listing exists at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update (CSPU).
Unauthenticated remote attackers can bypass access controls in the Imperative Web Server component of Oracle Helidon 3.2.18, gaining complete read access to all data accessible by the application and limited ability to modify or insert records via HTTP. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2 (High), reflecting a fully network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component exposes all Helidon-accessible data to unauthenticated remote attackers via HTTP. Tagged as an Authentication Bypass, the flaw enables any network-positioned attacker to read critical or complete Helidon-managed data without credentials or user interaction, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS 3.1 vector. No public exploit has been identified at time of analysis, but the absence of any exploitation prerequisites significantly elevates real-world urgency for any internet-facing or internally networked Helidon 3.2.18 deployment.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data access and partial data manipulation in Oracle Helidon 3.2.18's Imperative Web Server component allows a low-privileged attacker with HTTP network access to gain complete read access to all Helidon-accessible data and limited write capability. The vulnerability carries a scope change, meaning successful exploitation can cascade to impact additional products beyond Helidon itself within the Oracle Fusion Middleware ecosystem. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a realistic target for authenticated internal or service-account-level adversaries.
Local exploitation of Oracle Helidon 4.5.0's Imperative Web Server component enables a low-privileged attacker with infrastructure logon to bypass authentication controls and gain unauthorized access to all data accessible by the Helidon process, with limited write capability. Confirmed by Oracle's Critical Patch Update for August 2026 and corroborated by EUVD-2026-62096, this carries a CVSS 3.1 score of 6.1. No public exploit code or active exploitation has been identified at time of analysis.
Remote unauthenticated denial-of-service in Oracle Helidon 1.4.20 allows network-accessible attackers to crash or indefinitely hang the Imperative Web Server via HTTP, with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivially low exploitation complexity against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of network accessibility and zero prerequisites makes this a realistic operational risk for any deployment of the affected version.
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web Server component over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no authentication or user interaction required, per Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial exploitability rating warrants urgent patching.
Unauthorized data access and tampering in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged authenticated attackers to read or modify critical application data over HTTPS. The vulnerability is tagged as an authentication bypass, suggesting that a legitimately authenticated low-privilege user can circumvent authorization controls to access or alter data beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.1 CVSS score and high confidentiality and integrity impacts make this a meaningful risk in any deployment where untrusted low-privileged users have HTTPS access.
Unauthenticated remote exploitation of Oracle Helidon 3.2.20's Imperative Web Server component enables attackers to perform unauthorized creation, deletion, or modification of critical data via HTTP with no prerequisites. The vulnerability carries a scope change (S:C in CVSS), meaning successful exploitation can cascade to impact additional products or systems beyond Helidon itself. Tagged as an authentication bypass, this is classified by Oracle as easily exploitable with no public exploit identified at time of analysis.
Unauthorized data access in Oracle Helidon 4.5.0 exposes all data reachable through the Imperative Web Server component to unauthenticated remote attackers over HTTP. Tagged as an authentication bypass, the flaw allows complete confidentiality compromise - an attacker can read critical or all accessible application data without supplying credentials. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially executable from any network position.
Remote denial-of-service and partial data exposure in Oracle Helidon 4.5.0 allows unauthenticated network attackers via HTTP/2 to cause a complete hang or crash of the Helidon Imperative Web Server, alongside unauthorized read access to a subset of accessible data. The vulnerability is classified as easily exploitable with no authentication, user interaction, or special configuration required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a realistic denial-of-service threat against any exposed Helidon 4.5.0 deployment.
Remote denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network attackers to hang or repeatedly crash the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, zero-prerequisite exploitation against any reachable instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a credible threat to internet-facing deployments.
Denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to crash or indefinitely hang the service via crafted HTTP/2 traffic. Disclosed as part of Oracle's Critical Security Patch Update (CPU) for August 2026, the vulnerability is rated CVSS 7.5 with low attack complexity and no privileges required, making automated exploitation straightforward against any exposed instance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Denial of service in Oracle Helidon 3.2.19's Imperative Web Server allows unauthenticated network attackers to hang or crash the server entirely via HTTP/2 traffic. The CVSS 3.1 score of 7.5 reflects the low attack complexity and complete availability impact, with no authentication or user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers with HTTP network access to perform unauthorized read, write, and partial denial-of-service operations against data accessible to the service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms this is easily exploitable with no prerequisites, though impacts are bounded to partial CIA effects within the unchanged scope of the Helidon instance. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Partial denial of service in Oracle Helidon 4.5.3 is reachable by unauthenticated network attackers over HTTP, targeting the Imperative Web Server component within Oracle Fusion Middleware. Successful exploitation degrades availability without compromising confidentiality or integrity. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects a bounded, availability-only impact.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows network attackers over HTTP to achieve partial confidentiality disclosure, data manipulation, and denial of service - with a confirmed scope change indicating the impact can extend to components beyond Helidon's own security boundary. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) places this among the most easily reachable vulnerability classes: no credentials, no user interaction, and no elevated complexity required. Disclosed in Oracle's August 2026 Critical Security Patch Update, no public exploit code or CISA KEV listing has been identified at time of analysis.
Scope-changing compromise of Oracle Helidon 4.5.3 (Imperative Web Server component) lets a remote, unauthenticated attacker send HTTP requests that grant high-integrity write access to Helidon-accessible data, partial read disclosure, and a partial denial of service - with impact that can extend beyond Helidon into adjacent products. Rated CVSS 3.1 9.9 due to the scope change combined with easy, no-privilege network exploitation. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated network exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows remote attackers to partially compromise confidentiality, integrity, and availability of the affected system, with a confirmed scope change meaning attacks can extend impact to additional co-located products or services. The vulnerability is rated 8.3 (High) under CVSS 3.1, elevated by the scope change despite individually low CIA impact ratings. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers to bypass authentication controls via HTTP, resulting in unauthorized read access to a subset of application data and the ability to insert, update, or delete accessible records. The CVSS scope change (S:C) indicates successful exploitation can affect additional systems beyond the Helidon instance itself - a compounding factor in microservices topologies where Helidon acts as a gateway or intermediary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated, low-complexity attack path makes this credible against any internet-exposed deployment.
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
Unauthenticated remote exploitation of Oracle Helidon 1.4.19's Imperative Web Server component via HTTP allows attackers to perform unauthorized creation, deletion, and modification of critical application data, with partial read access to Helidon-accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero barriers to exploitation - no credentials, no user interaction, and low attack complexity over standard HTTP. Reported via Oracle's Critical Patch Update for August 2026 and tagged as an Authentication Bypass, with no public exploit code or CISA KEV listing identified at time of analysis.
Authentication bypass in Oracle Helidon 1.4.19 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote, unauthenticated attacker reach and manipulate protected data over HTTP, yielding full read and write access to all data the Helidon instance can reach. Oracle rates it CVSS 9.1 with High confidentiality and integrity impact and no availability impact, and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Integrity compromise in Oracle Helidon 1.4.20's Imperative Web Server component enables unauthenticated remote attackers to perform limited unauthorized data modifications via HTTP under high-complexity conditions. The vulnerability, tagged as an authentication bypass, allows circumvention of access controls to execute unauthorized update, insert, or delete operations on Helidon-accessible data without requiring credentials or user interaction. No public exploit code has been identified and no active exploitation is confirmed; the CVSS 3.7 Low score combined with high attack complexity (AC:H) significantly constrain real-world risk.
Unauthenticated data compromise in Oracle Helidon 1.4.19 (Imperative Web Server component) lets a remote attacker send crafted HTTP requests to read, create, modify, or delete all Helidon-accessible data. Oracle rates it CVSS 3.1 9.1 (high confidentiality and integrity impact, no availability impact) and classifies it as an authentication-bypass-class flaw. No public exploit identified at time of analysis, but the low attack complexity and no-authentication requirement make it a high-priority patch item once Oracle's fix is applied.
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Unauthenticated remote compromise in Oracle Helidon 4.5.0's Imperative Web Server component lets network attackers reach critical data and disrupt service over plain HTTP with no credentials and no user interaction. Oracle rates it CVSS 3.1 9.4, reflecting high confidentiality and integrity impact plus partial denial of service, and it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make it a top-tier patch priority.
Unauthorized data access in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass by Oracle, the flaw presents a moderate but concrete integrity and confidentiality risk for organizations running this specific microservice framework version. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and no user interaction requirement lower the barrier for exploitation by any authenticated user.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to partially compromise confidentiality, integrity, and availability via standard HTTP. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector confirms zero authentication or user interaction is required, and attack complexity is low - meaning successful exploitation demands minimal attacker skill or infrastructure. Disclosed through Oracle's Critical Patch Update for August 2026, no public exploit code has been identified at time of analysis, though the low-barrier network vector warrants prompt remediation for any internet-exposed Helidon deployment.
Unauthenticated compromise of Oracle Helidon 4.5.0 lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the Helidon application via a flaw in the Imperative Web Server component. Oracle rates it CVSS 9.1 (high confidentiality and integrity impact, no availability impact), and the vendor tag 'Authentication Bypass' indicates protected routes/resources can be reached without credentials. No public exploit identified at time of analysis; addressed in the Oracle Critical Patch Update of August 2026.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) allows a network attacker to read, create, modify, or delete all data accessible to the framework over HTTP. Tagged by Oracle as an authentication bypass, it carries a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact and no availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it as easily exploitable, warranting prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers to cause a persistent hang or repeated crash of the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial remote exploitation with no authentication or user interaction required, making this reliably triggerable against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, but low attack complexity means operational risk for teams running Helidon 4.5.0 in production microservice environments is meaningful.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows attackers with HTTP network access to read a subset of application-accessible data and trigger partial denial of service conditions. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L vector confirms low-complexity, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; this issue was disclosed through Oracle's Critical Security Patch Update for August 2026 (EUVD-2026-62158).
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an Authentication Bypass by Oracle Security, the flaw is rated Medium (CVSS 5.4) with low attack complexity, meaning any attacker holding even minimal credentials can trivially exploit it without user interaction. No public exploit code or CISA KEV listing is associated at time of analysis, though the straightforward exploitation conditions make this a credible threat in multi-tenant or shared-access Helidon deployments.
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server component over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw yields full compromise of confidentiality, integrity, and availability (CVSS 9.8) without credentials or user interaction. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Unauthorized data access and manipulation in Oracle Helidon 4.5.0's Imperative Web Server allows low-privileged network attackers to read restricted data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables authenticated users to exceed their intended authorization scope within the Helidon application. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though Oracle's August 2026 Critical Patch Update confirms the issue.
Unauthorized read access to data in Oracle Helidon 4.5.1's Imperative Web Server component is achievable by unauthenticated network attackers via HTTP, exploiting what the vendor tags as an authentication bypass condition. The affected version is precisely 4.5.1 of Oracle's Java microservices framework, and the vulnerability exposes a subset of data accessible to the server without requiring any credentials or user interaction. No public exploit has been identified at time of analysis, and Oracle has disclosed this issue as part of its August 2026 Critical Patch Update.
Authentication bypass in Oracle Helidon 3.2.19 Imperative Web Server exposes critical data to unauthenticated network attackers via HTTP. The flaw, tagged as an Authentication Bypass by the reporter, allows a remote attacker without credentials to gain complete read access to all data accessible by the Helidon server instance. No public exploit code or active exploitation has been identified at time of analysis; however, the high confidentiality impact warrants timely patching in any environment running this specific version.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated, network-adjacent attackers to read critical application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial exploitability with no authentication or user interaction required. Classified under the Authentication Bypass tag by Oracle, this vulnerability is covered in the Oracle Critical Patch Update for August 2026, with no public exploit code or CISA KEV listing identified at time of analysis.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to access critical or all Helidon-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required (PR:N/UI:N) and a high confidentiality impact. Disclosed as part of Oracle's Critical Patch Update for August 2026, no public exploit or CISA KEV listing has been identified at time of analysis.
The Imperative Web Server in Oracle Helidon 4.5.0 exposes an authentication bypass that permits remote unauthenticated HTTP attackers to read a subset of application-accessible data. Tagged by Oracle CSIRT as an authentication bypass and disclosed in the August 2026 Critical Patch Update, the flaw carries a CVSS 5.3 Medium score with network-accessible, zero-complexity exploitation conditions - conditions that may understate practical risk given the complete absence of authentication prerequisites. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified at time of analysis.
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data access and modification is possible in Oracle Helidon 4.5.1 via a flaw in its Imperative Web Server component, classified under the Authentication Bypass tag. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can exploit this over HTTP with no user interaction and low attack complexity. Successful exploitation results in partial confidentiality and integrity compromise of Helidon-accessible data; no patch version has been independently confirmed beyond the Oracle August 2026 CPU advisory.
Authentication bypass in Oracle Helidon 4.5.1 (Imperative Web Server component) exposes applications to unauthenticated remote attackers who can create, modify, or delete critical data accessible to the service via standard HTTP requests. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 7.5, reflecting a network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Patch Update.
Unauthenticated remote denial-of-service in Oracle Helidon 3.2.19 allows a network attacker to hang or crash the Imperative Web Server component via crafted HTTP requests, causing complete loss of service availability. The vulnerability requires no privileges, no user interaction, and is reachable over standard HTTP, making it trivially exploitable against any exposed Helidon 3.2.19 instance. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Unauthorized data access in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network-based attackers to read a subset of Helidon-accessible data and perform unauthorized insert, update, or delete operations against the same data store. The 'Authentication Bypass' tag in the intelligence feeds indicates the underlying mechanism circumvents expected access controls on HTTP endpoints. With AC:H, exploitation is non-trivial - specific conditions must be met - and no active exploitation has been identified; however, the unauthenticated network vector warrants patching in production deployments.
Unauthorized read access to application data is achievable against Oracle Helidon 4.5.1's Imperative Web Server component via unauthenticated HTTP requests. The vulnerability, tagged as an Authentication Bypass, allows remote attackers with network access to retrieve a subset of data without credentials, as confirmed by the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit has been identified at time of analysis, and the issue is addressed in Oracle's Critical Patch Update for August 2026.
Unauthorized data read in Oracle Helidon 3.2.19's Imperative Web Server component allows unauthenticated remote attackers to access a subset of protected application data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no credentials or user interaction required, consistent with the intelligence tag of Authentication Bypass. Impact is bounded to confidentiality only (C:L, I:N, A:N), suggesting an access control bypass that exposes a partial data view rather than full system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting or client-side injection in Oracle Helidon 4.5.0's Imperative Web Server component enables unauthenticated, network-accessible attacks that produce partial confidentiality and integrity impacts while extending harm to additional products through a scope change. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is the canonical fingerprint of reflected or stored XSS - an attacker delivers a crafted HTTP payload that, once interacted with by a victim user, executes within a different security scope such as a browser session. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog; Oracle disclosed it through the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Helidon 4.1.0's Imperative Web Server component allows network-accessible attackers to bypass authentication controls via HTTP, resulting in unauthorized partial read and write access to application data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no prerequisites beyond network reachability, and the 'Authentication Bypass' tag corroborates an access-control failure in the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and zero-authentication requirement make this an attractive target for automated scanning.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality and availability degradation rather than full system compromise.
Unauthorized data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data via HTTP. Tagged as an authentication bypass, the vulnerability is trivially exploitable with no complexity barriers - any attacker with HTTP access to the service can trigger it. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and impact is constrained to partial confidentiality loss with no integrity or availability consequences.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to perform unauthorized read access to a subset of data, unauthorized data modification, and partial denial of service - all without credentials or user interaction. Oracle classifies this as 'easily exploitable' in its August 2026 Critical Patch Update advisory. No public exploit identified at time of analysis, but the low attack complexity and network accessibility make this a straightforward target for opportunistic attackers.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to bypass authentication and perform unauthorized read and write operations on application data over HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team, this vulnerability exposes a subset of Helidon-accessible data to disclosure and tampering without requiring credentials or user interaction. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the low attack complexity and zero-privilege requirement make it a straightforward target for automated scanning.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability, tagged as an Authentication Bypass by Oracle, is remotely exploitable without credentials or user interaction against the affected version. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and absence of authentication requirements make this straightforward to exploit once a target instance is identified.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP allows attackers to read a subset of accessible data, perform unauthorized write/modify operations, and cause a partial denial of service. The CVSS vector confirms network accessibility with no authentication, no user interaction, and low attack complexity, making this easily exploitable against exposed deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial exploitation conditions warrant prompt patching.
Remote denial-of-service in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to crash or indefinitely hang the server by sending crafted HTTP/2 traffic. The vulnerability carries a CVSS 7.5 rating with low attack complexity and no credential or interaction requirement, making it trivially scriptable from any network-accessible position. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated remote attackers to read a subset of application-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, meaning protections that should gate read access can be circumvented without credentials. No public exploit code has been identified at time of analysis, and it has not been listed in the CISA KEV catalog, though Oracle disclosed this via their August 2026 Critical Patch Update (CPU).
Unauthorized data exposure in Oracle Helidon 4.5.0's Imperative Web Server enables unauthenticated remote attackers to read a subset of application-accessible data via HTTP, confirmed by Oracle's August 2026 Critical Patch Update. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable, zero-complexity network access requiring no authentication or user interaction. No public exploit has been identified at time of analysis, though the 'Authentication Bypass' tag from multi-source intelligence indicates a structural access control failure in the HTTP request handling pipeline.
Unauthenticated remote access to sensitive data affects Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2, allowing an attacker with network access to read critical or all data accessible to the Helidon application. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required. No public exploit identified at time of analysis, and the flaw is disclosed through Oracle's Critical Patch Update for August 2026.
Unauthenticated remote exploitation of the Imperative Web Server component in Oracle Helidon 4.5.0 allows network-accessible attackers to perform unauthorized read and write operations against application-accessible data, with confirmed scope change indicating downstream impact on adjacent systems beyond the directly targeted Helidon instance. The vulnerability is tagged as an authentication bypass, meaning the HTTP-exposed service fails to enforce access controls on one or more endpoints. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though Oracle's Critical Patch Update advisory for August 2026 confirms the vulnerability's existence and assigns a CVSS 3.1 score of 7.2.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server allows remote unauthenticated attackers to read a subset of application data and make unauthorized modifications via HTTP, with a scope change indicating potential cascade impact to downstream services. The CVSS 3.1 score of 7.2 (High) is elevated by the scope change (S:C), reflecting Helidon's common role as a gateway or orchestrator in microservices architectures. No public exploit or CISA KEV listing has been identified at time of analysis, but the fully unauthenticated, low-complexity, network-accessible attack profile makes this a credible and time-sensitive patching priority for any internet-exposed deployment.
Unauthenticated information disclosure in Oracle Helidon 4.5.0's Imperative Web Server component exposes complete application data to remote network attackers via HTTP. Tagged as an authentication bypass, the flaw allows any unauthenticated actor with network access to read critical or all Helidon-accessible data without any privileges or user interaction. No patch version has been independently confirmed beyond the Oracle CPU August 2026 advisory, and no active exploitation has been identified at time of analysis.
Unauthenticated confidentiality breach in Oracle Helidon 3.2.18's Imperative Web Server component exposes all accessible data to remote attackers over HTTP. Tagged as an authentication bypass, this flaw requires no credentials, no user interaction, and no special network positioning - any attacker with HTTP access to a vulnerable instance can read critical application data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit opportunistically.
Denial-of-service in Oracle Helidon 3.2.19's Imperative Web Server component allows remote unauthenticated attackers to cause a complete hang or repeatable crash via HTTP, fully disrupting service availability. The vulnerability requires no authentication, no user interaction, and no special configuration, making it trivially exploitable against any network-accessible Helidon 3.2.19 instance. No public exploit code has been identified and it does not appear in CISA KEV at time of analysis, though the low attack complexity elevates operational risk for any exposed deployment.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-adjacent attacker to read unauthorized data subsets and perform unauthorized insert, update, or delete operations via HTTP. Rated CVSS 5.4 Medium with low attack complexity and no user interaction required, this flaw is tagged as an authentication bypass by multi-source intelligence, suggesting a low-privileged user can exceed their authorized scope within the Helidon web layer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local high-privilege information disclosure in Oracle Helidon 4.5.1's Imperative Web Server component allows an attacker with OS-level logon access to the hosting infrastructure to read all data accessible to the Helidon process. The CVSS vector (AV:L/AC:L/PR:H) confirms exploitation is constrained to local infrastructure access with elevated credentials, resulting in complete confidentiality loss (C:H) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can create, delete, or modify critical data in Oracle Helidon 4.5.1 by bypassing authentication controls in the Imperative Web Server component over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network reachability with no credentials, no user interaction, and no elevated access - placing this firmly in the easily exploitable category per Oracle's own classification. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity warrants prompt patching for any internet-exposed Helidon deployments.
Unauthenticated remote data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows network attackers to bypass authentication and gain complete access to data served by the application via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, user interaction, or special access are required, and Oracle's own advisory characterizes the vulnerability as 'easily exploitable.' No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the authentication bypass nature paired with a High confidentiality impact warrants prompt remediation.
Authentication bypass in Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to read a subset of data accessible within the Helidon service over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable from any network location against default deployments without credentials. Impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequence, though the 'Authentication Bypass' tag suggests access-control logic failures that may expose protected endpoints. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability carries a scope-change designation (S:C in CVSS), meaning successful exploitation may cascade beyond Helidon itself to impact additional products or services in the surrounding microservices environment. No public exploit code or active exploitation has been confirmed at time of analysis, but the zero-prerequisite attack profile - no authentication, low complexity, no user interaction - makes this straightforward to exploit once the bypass mechanism is understood.
Unauthenticated network exploitation of Oracle Helidon 3.2.19's Imperative Web Server component allows remote attackers to bypass authentication over HTTP, gaining unauthorized read access to a subset of data and the ability to insert, update, or delete accessible data. The CVSS S:C scope change is particularly significant: in microservices environments where Helidon acts as a service layer, successful exploitation may cascade to impact downstream or co-located systems beyond the initially compromised component. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the zero-prerequisites attack profile (AV:N/AC:L/PR:N/UI:N) and scope change make this a prioritized patching target for any organization running the affected version.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows a low-privileged, network-authenticated attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that existing access controls within the Imperative Web Server can be circumvented by an attacker who holds any valid low-privilege credential. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component allows low-privileged network attackers to read a subset of accessible data and perform unauthorized write, insert, or delete operations. Exploitation via HTTP requires high attack complexity and at least low-level authentication, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Helidon 4.5.0 affects the Imperative Web Server component, enabling unauthenticated network attackers to read a subset of accessible application data via HTTP. Tagged as an authentication bypass, the flaw requires no privileges or user interaction, making it trivially reachable from any network vantage point. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis, though its zero-authentication, low-complexity profile warrants timely patching in network-exposed deployments.
Unauthorized data read in Oracle Helidon 3.2.18 allows unauthenticated remote attackers to access a subset of data served by the Imperative Web Server component over HTTP, with no credentials or user interaction required. Tagged as an Authentication Bypass by Oracle CERT, the flaw is classified as 'easily exploitable' in Oracle's August 2026 Critical Patch Update advisory. No public exploit code or active exploitation has been identified at time of analysis, but the absence of any authentication prerequisite lowers the bar for opportunistic reconnaissance.
Cross-site scripting or authentication bypass in Oracle Helidon 4.1 Imperative Web Server (version 4.5.0) allows unauthenticated remote attackers to perform unauthorized read and write operations against Helidon-accessible data, with scope change extending impact to additional dependent products. Exploitation requires victim interaction, consistent with a reflected XSS or similar client-side injection pattern in the HTTP server component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers once a victim is lured.
Cross-site scripting or equivalent client-side injection in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to compromise confidentiality and integrity of Helidon-accessible data when a victim user interacts with attacker-controlled content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is a canonical XSS fingerprint - scope change combined with user interaction and partial C/I impact - despite the 'Authentication Bypass' tag in the intelligence metadata, which may indicate a secondary or misclassified characteristic. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component exposes HTTP endpoints to unauthenticated network attackers, enabling unauthorized read access to a subset of application data and unauthorized write, insert, or delete operations on accessible data. The flaw, tagged as an Authentication Bypass by Oracle and reported via the August 2026 Critical Patch Update, is reachable by any attacker with HTTP connectivity to the service with no complexity barriers. No public exploit code has been identified and the vulnerability is not currently listed in CISA KEV, but the zero-authentication network attack vector warrants prompt patching of affected Helidon 4.5.0 deployments.
Unauthenticated network exploitation of Oracle Helidon 3.2.18's Imperative Web Server component allows remote attackers to bypass authentication controls, gaining unauthorized read access to a subset of application data and unauthorized write/insert/delete capability against some accessible data. Tagged as an authentication bypass by Oracle Security (secalert_us@oracle.com), the vulnerability requires no privileges and no user interaction, making it trivially automatable over HTTP. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has disclosed this via their August 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle Helidon 4.5.0 (Imperative Web Server component of Oracle Fusion Middleware) lets a remote attacker reach and manipulate all data accessible to the framework over HTTP. Tagged as an authentication bypass, it carries a CVSS 9.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Helidon 3.2.18 (Imperative Web Server component of Oracle Fusion Middleware) lets an unauthenticated remote attacker send crafted HTTP requests to read, create, modify, or delete any data the application can access. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it is trivially exploitable over the network with no user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Helidon 4.5.0 (Imperative Web Server component, part of Oracle Fusion Middleware) lets a network attacker read, create, delete or modify all Helidon-accessible data and cause a partial denial of service, all over HTTP without credentials. Oracle rates this CVSS 9.4 and tags it as an authentication bypass, meaning attackers reach protected functionality without logging in. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Helidon 3.2.18 (Imperative Web Server component) lets network attackers read, alter, or destroy all data the framework can access and degrade its availability. The flaw is remotely reachable over HTTP with no authentication or user interaction and carries a CVSS 3.1 base score of 9.4. It was disclosed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access in Oracle Helidon 3.2.18 (Imperative Web Server component) allows a low-privileged, network-adjacent attacker to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. Tagged as an authentication bypass, the flaw enables privilege escalation beyond the attacker's authorized scope within the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in source intelligence.
Full remote takeover in Oracle Helidon 3.2.18 (Fusion Middleware, Imperative Web Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the affected instance. Oracle rates the flaw CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as "easily exploitable," fixed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component exposes sensitive application data to unauthenticated network attackers over HTTP. Successful exploitation yields complete read access to all Helidon-accessible data and limited write capability (insert, update, delete), with no availability impact. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the high attack complexity rating tempers immediate mass-exploitation risk, though the confidentiality impact warrants prompt patching for internet-exposed deployments.
Helidon 3.2.18's Imperative Web Server component exposes an unauthenticated, network-accessible denial-of-service condition via HTTP that allows remote attackers to partially degrade service availability without any credentials or user interaction. Only the Availability dimension is affected - Confidentiality and Integrity remain intact - classifying this as a medium-severity partial DoS. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a lower operational priority tier despite its trivial exploitation conditions.
Full instance takeover of Oracle Helidon 3.2.18 (Imperative Web Server component) is achievable by a low-privileged remote attacker over HTTP, though exploitation demands high attack complexity. The CVSS 3.1 score of 7.5 reflects complete confidentiality, integrity, and availability compromise - consistent with the vendor description of 'takeover' - affecting Oracle Fusion Middleware deployments running this specific release. No public exploit code or CISA KEV listing exists at time of analysis; Oracle addressed this in the August 2026 Critical Security Patch Update (CSPU).
Unauthenticated remote attackers can bypass access controls in the Imperative Web Server component of Oracle Helidon 3.2.18, gaining complete read access to all data accessible by the application and limited ability to modify or insert records via HTTP. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2 (High), reflecting a fully network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component exposes all Helidon-accessible data to unauthenticated remote attackers via HTTP. Tagged as an Authentication Bypass, the flaw enables any network-positioned attacker to read critical or complete Helidon-managed data without credentials or user interaction, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS 3.1 vector. No public exploit has been identified at time of analysis, but the absence of any exploitation prerequisites significantly elevates real-world urgency for any internet-facing or internally networked Helidon 3.2.18 deployment.
Unauthorized data read in Oracle Helidon 4.5.0's Imperative Web Server component exposes a subset of server-accessible data to unauthenticated remote attackers over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable without credentials, and the 'Authentication Bypass' tag from intelligence sources suggests access controls within the Imperative Web Server are being circumvented rather than simply an information leak. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Unauthenticated remote data modification is possible in Oracle Helidon 3.2.19 via its Imperative Web Server component, exploitable over HTTP with no credentials or user interaction required. Successful exploitation allows an attacker to perform unauthorized insert, update, or delete operations on data accessible to the Helidon instance, with no confidentiality or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized data access and partial data manipulation in Oracle Helidon 3.2.18's Imperative Web Server component allows a low-privileged attacker with HTTP network access to gain complete read access to all Helidon-accessible data and limited write capability. The vulnerability carries a scope change, meaning successful exploitation can cascade to impact additional products beyond Helidon itself within the Oracle Fusion Middleware ecosystem. No public exploit code has been identified at time of analysis, but the low attack complexity and absence of required user interaction make this a realistic target for authenticated internal or service-account-level adversaries.
Local exploitation of Oracle Helidon 4.5.0's Imperative Web Server component enables a low-privileged attacker with infrastructure logon to bypass authentication controls and gain unauthorized access to all data accessible by the Helidon process, with limited write capability. Confirmed by Oracle's Critical Patch Update for August 2026 and corroborated by EUVD-2026-62096, this carries a CVSS 3.1 score of 6.1. No public exploit code or active exploitation has been identified at time of analysis.
Remote unauthenticated denial-of-service in Oracle Helidon 1.4.20 allows network-accessible attackers to crash or indefinitely hang the Imperative Web Server via HTTP, with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivially low exploitation complexity against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of network accessibility and zero prerequisites makes this a realistic operational risk for any deployment of the affected version.
Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web Server component over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no authentication or user interaction required, per Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial exploitability rating warrants urgent patching.
Unauthorized data access and tampering in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged authenticated attackers to read or modify critical application data over HTTPS. The vulnerability is tagged as an authentication bypass, suggesting that a legitimately authenticated low-privilege user can circumvent authorization controls to access or alter data beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.1 CVSS score and high confidentiality and integrity impacts make this a meaningful risk in any deployment where untrusted low-privileged users have HTTPS access.