This vulnerability in Siebel CRM Cloud Applications enables a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data, including the ability to create, delete, or modify data across all accessible Siebel CRM Cloud Applications. The affected versions are from 22.3 up to and including 26.6. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle's advisory for the August 2026 Critical Security Patch Update references this vulnerability among many others but does not explicitly state patch availability for this specific CVE in the provided content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel CRM Cloud Applications, resulting in complete compromise of accessible data confidentiality and integrity. There is no impact on availability. This could severely affect organizations relying on Siebel CRM for critical business data management.

Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Although the vendor advisory references the August 2026 Critical Security Patch Update, it does not explicitly confirm a patch for CVE-2026-61321 in the provided content. Therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. Until patched, restricting network access to Siebel CRM Cloud Applications and monitoring for suspicious activity may reduce risk.