This vulnerability in Oracle Siebel CRM Integration (REST component) affects supported versions 17.0 through 26.6. It permits an unauthenticated attacker with network access over HTTPS to compromise the integration component. The impact includes unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all data accessible via Siebel CRM Integration. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. No known exploits in the wild have been reported. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for this specific issue.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Siebel CRM Integration, as well as unauthorized access to critical or complete data sets. This compromises confidentiality and integrity of the affected system. There is no reported impact on availability. The vulnerability is rated high severity with a CVSS score of 7.4.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. The August 2026 Critical Security Patch Update advisory includes multiple patches across Oracle products; however, patch availability for this specific vulnerability is not explicitly confirmed in the advisory. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch information and apply any relevant updates to Siebel CRM Integration versions 17.0 through 26.6 without delay. If patches are not yet available, monitor Oracle advisories closely for updates.