This vulnerability affects Oracle Siebel Apps - Marketing versions 17.0 through 26.5 and allows a low privileged attacker with network access via HTTP to fully compromise the application. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 fixes but does not specify a dedicated patch version for Siebel Apps - Marketing in the provided content. Oracle strongly urges customers to apply the Critical Security Patch Update promptly to mitigate this risk. Until patches are applied, risk reduction may be achieved by blocking required network protocols or limiting privileges, though these may impact application functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to take over the Siebel Apps - Marketing application, resulting in complete compromise of confidentiality, integrity, and availability of the affected component.

Oracle recommends applying the June 2026 Critical Security Patch Update immediately to address this vulnerability. Until patches are applied, customers may reduce risk by blocking network protocols required for exploitation and removing unnecessary privileges from users, understanding these actions may disrupt application functionality. Patch status is not explicitly confirmed for this vulnerability; therefore, customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest remediation guidance.