Oracle Helidon versions 1.0.0 through 1.4.19 contain a vulnerability in the Imperative Web Server component that allows an unauthenticated attacker with network access to compromise the application. This weakness is classified as CWE-284 and permits unauthorized update, insert, or delete access to some of Helidon accessible data, thereby affecting the integrity of the protected resources. The CVSS v3.1 vector indicates restricted attack complexity and no user interaction, with a low integrity impact and a base score of 3.7.

The affected system is Oracle Helidon versions 1.0.0 through 1.4.19. No versions 1.4.20 or later are reported as vulnerable, and the vulnerability is specific to the Helidon Imperative Web Server functionality within Oracle Fusion Middleware.

The score of 3.7 indicates low severity according to the CVSS v3.1 scale. Because the exploit requires only network connectivity to HTTP endpoints and no prior authentication, the vulnerability can be triggered remotely against exposed deployments of Helidon versions 1.0.0 through 1.4.19. The EPSS score is <1%, indicating a very low probability of exploitation, yet the vulnerability remains a concern for public-facing services. The issue is not listed in the CISA KEV catalogue, but the nature of the vulnerability suggests that if a Helidon service is left exposed to untrusted hosts, the risk remains realistic. Attacks would typically target the Helidon HTTP service from the perimeter, and mitigation should focus on patching, restricting network exposure, and ensuring proper authorization controls at the application layer.