This vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (REST component) affects supported versions 17.0 through 26.6. It allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially resulting in unauthorized creation, deletion, or modification of critical data or unauthorized access to all accessible data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impacts. Oracle's August 2026 Critical Security Patch Update addresses this vulnerability among 943 others, and customers are urged to apply patches without delay.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel CRM Integration or unauthorized access to all data accessible through the integration. This compromises confidentiality and integrity of sensitive business data. There is no reported impact on availability. The vulnerability is difficult to exploit and requires network access via HTTP but no authentication or user interaction.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability. Customers should apply the official Oracle patches promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.