This vulnerability in Oracle Siebel CRM Integration (REST component) affects versions from 17.0 up to and including 26.6. It permits an unauthenticated attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low availability impact. The vendor advisory references a Critical Security Patch Update released in August 2026, which includes numerous patches across Oracle products, but does not explicitly confirm patch availability for this specific vulnerability.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Siebel CRM Integration and can cause a partial denial of service, impacting system availability. The confidentiality impact is high, while integrity impact is not affected, and availability impact is low.

Oracle strongly recommends applying the latest Critical Security Patch Update released in August 2026, which addresses numerous vulnerabilities including those in Oracle products. Customers should remain on actively supported versions and promptly apply available security patches. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, verify patch availability and installation instructions via the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No vendor advisory states that no action is required or that the vulnerability is already mitigated.