This vulnerability in Oracle Siebel CRM Deployment (Migration component) affects supported versions 17.0 through 26.6. It permits a low privileged attacker with network access over HTTP to compromise the deployment, resulting in unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Siebel CRM Deployment, including unauthorized modification (update, insert, delete) of some data. The vulnerability's scope change means it may impact additional Oracle products beyond Siebel CRM Deployment. The high CVSS score reflects significant confidentiality and integrity risks but no availability impact.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available patches promptly and remain on actively supported versions to mitigate the risk. No additional mitigation steps are indicated by the vendor advisory.