This vulnerability exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications versions 22.3 to 26.6. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can lead to unauthorized access to sensitive data and limited unauthorized modification capabilities (update, insert, delete) within the application. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change. Confidentiality impact is high, integrity impact is low, and availability impact is none. The vulnerability may also affect additional Oracle products due to scope change. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation status for Siebel CRM Cloud Applications.

Exploitation of this vulnerability can result in unauthorized access to critical data within Siebel CRM Cloud Applications and unauthorized modification (update, insert, delete) of accessible data. The confidentiality impact is high, meaning sensitive data could be exposed. Integrity impact is low, indicating some data modification is possible. Availability is not affected. The vulnerability affects multiple versions from 22.3 through 26.6. There are no known exploits in the wild at this time.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Updates. However, the provided advisory content does not explicitly confirm patch availability or provide a direct patch link for Siebel CRM Cloud Applications. Users should monitor Oracle's official security alerts and apply any relevant patches once available. Until then, follow Oracle's guidance and maintain updated versions within supported ranges. No vendor advisory states that no action is required or that the issue is already mitigated.