This vulnerability exists in the Marketing component of Oracle Siebel CRM's Siebel Apps - Marketing product, affecting versions from 17.0 up to and including 26.6. It permits a low privileged attacker with network access via HTTP to compromise the application, potentially resulting in full takeover. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has acknowledged this vulnerability in its August 2026 Critical Security Patch Update and strongly recommends applying security patches promptly to mitigate risk.

Successful exploitation can lead to complete compromise of the Siebel Apps - Marketing application, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected application component, potentially leading to unauthorized access and control over marketing data and functionality.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to remain on actively supported versions and apply the available patches without delay. No indication of alternative mitigations or that no action is required is provided; therefore, patching is the recommended remediation.