This vulnerability in Oracle Siebel CRM End User (component: Search) allows an unauthenticated attacker who has access to the physical communication segment of the hardware where the product runs to compromise the application. The attacker can gain unauthorized creation, deletion, or modification access to critical or all accessible data within Siebel CRM End User. The vulnerability affects versions >=17.0 and <=26.6. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no required privileges or user interaction, and attack vector is adjacent network.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or all data accessible by Siebel CRM End User. It also allows unauthorized access to critical or complete data within the application. This poses a significant risk to data confidentiality and integrity but does not impact availability.

Oracle has released this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected versions of Siebel CRM End User. Since this is not a cloud service, remediation requires applying the official patches provided by Oracle. Patch status is confirmed by the Oracle advisory. No alternative mitigations or workarounds are specified in the advisory.