The vulnerability resides in the Helidon gRPC server component of Oracle Fusion Middleware, allowing an unauthenticated attacker to perform update, insert, or delete operations and read a subset of data through HTTP/2 connections. The weakness is an Information Exposure flaw (CWE‑200), leading to both confidentiality and integrity breaches. The flaw can be triggered simply by sending traffic to a reachable Helidon instance without credentials, and the impact can extend beyond Helidon to other Oracle products that interact with the affected service due to a scope change.

Oracle Helidon versions 3.0.0 to 3.2.21 are affected. These releases provide gRPC server functionality for Oracle Fusion Middleware environments that expose the Helidon services to internal or external networks.

The CVSS v3.1 base score of 7.2 indicates high severity. The EPSS score of less than 1% suggests a very low but non‑zero probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw over the network via HTTP/2 without authentication, leading to unauthorized data modifications and limited read access. Due to the easy exploitation path and potential impact on confidentiality and integrity, rapid remediation is advisable.