This vulnerability in the Siebel Apps - Marketing component of Oracle Siebel CRM allows a low privileged attacker with network access over HTTP to compromise the application. Successful exploitation can lead to unauthorized access to critical or all accessible data and can cause a partial denial of service. The vulnerability affects versions 17.0 through 26.6 inclusive. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to sensitive data within Siebel Apps - Marketing and potentially cause a partial denial of service. This compromises confidentiality and availability of the affected system.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.