This vulnerability in Siebel CRM Cloud Applications allows a high privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability affects versions from 22.3 up to and including 26.6. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) indicates network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts without availability impact. Oracle's advisory for the August 2026 Critical Security Patch Update includes this vulnerability among 943 fixes and strongly urges customers to apply patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel CRM Cloud Applications, compromising confidentiality and integrity of all accessible data. The vulnerability's scope change means it may also impact additional Oracle products. The CVSS score of 8.7 reflects a high severity with significant potential damage to data integrity and confidentiality. There are no reported active exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers should apply the official patches provided by Oracle promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch availability details and installation instructions are provided in the Oracle advisory. No alternative mitigations or workarounds are specified.