This vulnerability affects Oracle Siebel Apps - Marketing (component: Marketing) in versions 17.0 through 26.6. An attacker with low privileges and network access via HTTP can exploit this flaw to gain unauthorized ability to create, delete, or modify critical data within the application. The vulnerability also enables causing a hang or frequent crashes, leading to complete denial of service. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. Oracle has published a Critical Security Patch Update in August 2026 addressing multiple vulnerabilities, including this one, and strongly recommends applying patches promptly.

Successful exploitation allows unauthorized modification of critical data in Siebel Apps - Marketing and can cause denial of service by hanging or crashing the application. This impacts data integrity and availability but does not affect confidentiality. The vulnerability is exploitable by an attacker with low privileges over the network without user interaction.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to remediate this vulnerability. Remaining on actively supported versions and promptly applying Oracle security patches is critical to prevent exploitation. Patch availability details are provided in the Oracle advisory: https://www.oracle.com/security-alerts/cspuaug2026.html