This vulnerability in Oracle Siebel CRM Cloud Applications (component: Siebel Cloud Manager) affects supported versions 22.3 through 26.6. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data, unauthorized read access to a subset of data, and the ability to cause a hang or frequent crash (denial of service) of the application. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, with a base score of 8.3.

The vulnerability allows unauthorized modification and deletion of critical data, unauthorized reading of some data, and denial of service by causing application hangs or crashes. This compromises confidentiality, integrity, and availability of the Siebel CRM Cloud Applications data and service.

Oracle has released security patches addressing this and many other vulnerabilities in their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches without delay and remain on actively supported versions. Patch availability and installation instructions are provided in Oracle's advisory at https://www.oracle.com/security-alerts/cspuaug2026.html. No indication of 'no action required' or 'already mitigated' is present; therefore, patching is the recommended mitigation.