This vulnerability in Oracle Siebel CRM Integration (REST component) affects versions 17.0 through 26.6. It permits an unauthenticated attacker with network access over HTTPS to compromise the system, potentially leading to unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible via Siebel CRM Integration. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update and strongly advises applying patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel CRM Integration, as well as unauthorized access to all data accessible through the integration. This compromises confidentiality and integrity of sensitive business data. There is no impact on availability reported. The vulnerability requires network access via HTTPS and is difficult to exploit.

Oracle has released security patches for this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches without delay to mitigate the risk. Staying on actively supported versions and promptly applying Oracle patches is critical. No alternative mitigations or workarounds are specified in the advisory.