This vulnerability in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) affects version 17.0 and allows an attacker with low privileges and network access via HTTP to compromise the application. The vulnerability has a CVSS 3.1 score of 8.8 with high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory addresses this and many other vulnerabilities, urging customers to apply patches without delay. While the advisory does not explicitly list a fixed version for Siebel CRM Cloud Applications, it strongly recommends applying the Critical Security Patch Update to mitigate this and other vulnerabilities. Until patched, risk reduction may be achieved by blocking required network protocols or removing unnecessary privileges, though these may impact functionality.

Successful exploitation can lead to complete compromise of Oracle Siebel CRM Cloud Applications, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the application, potentially leading to unauthorized data access, modification, or service disruption.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk can be reduced by blocking network protocols required for exploitation and removing unnecessary privileges from users. These mitigations may affect application functionality. Patch status is not explicitly confirmed in the advisory; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and instructions.