This vulnerability exists in the Siebel CRM Cloud Applications product of Oracle Siebel CRM, specifically in the Siebel Cloud Manager component. It affects supported versions from 22.3 up to and including 26.6. The flaw allows an attacker with low privileges and network access over HTTP to compromise the application, resulting in a complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle's advisory for the August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches across multiple products.

Successful exploitation can lead to complete compromise of Siebel CRM Cloud Applications, affecting confidentiality, integrity, and availability of the system. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond Siebel CRM Cloud Applications. The CVSS 3.1 base score of 9.9 reflects the critical nature of this vulnerability.

Oracle has released security patches as part of the August 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying all security updates. No indication was given that the vulnerability is already mitigated or requires no action.