This vulnerability affects Oracle Siebel Apps - Marketing (component: Marketing) in versions 17.0 through 26.6. It allows an unauthenticated attacker with network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all accessible data. The CVSS 3.1 base score is 7.4, indicating high severity, with confidentiality and integrity impacts. The attack complexity is high, and no privileges or user interaction are required. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability as part of a large set of fixes but does not provide a direct patch link in the provided data.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel Apps - Marketing, as well as unauthorized access to all accessible data. This compromises confidentiality and integrity of the affected system's data. The vulnerability does not impact availability. The attack requires network access via HTTP but no authentication.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant patches from this update promptly. Since no direct patch link is provided, users should refer to Oracle's official August 2026 Critical Security Patch Update advisory for patch availability and installation instructions. Remaining on actively supported versions and timely patching are critical to mitigate this vulnerability.