This vulnerability in Oracle Siebel CRM Cloud Applications enables an unauthenticated attacker with network access over HTTP to compromise the application and access sensitive data. It affects supported versions from 22.3 to 26.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the attack can be performed remotely with low complexity, no privileges, and no user interaction, resulting in a high confidentiality impact but no integrity or availability impact. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function). The vendor advisory references Oracle's July 2026 Critical Patch Update but does not explicitly confirm patch availability or remediation status for this specific vulnerability.

Successful exploitation can lead to unauthorized access to critical or complete data within Siebel CRM Cloud Applications, compromising confidentiality. There is no reported impact on integrity or availability. The vulnerability can be exploited remotely without authentication, increasing the risk of data exposure.

Patch status is not yet confirmed—check the Oracle July 2026 Critical Patch Update advisory for current remediation guidance at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected Siebel CRM Cloud Applications and monitor for unusual access patterns.