This vulnerability in Oracle Siebel CRM Administration (Data Archival component) affects supported versions 25.12 through 26.6. It permits a low privileged attacker with network access over HTTP to compromise the administration interface, resulting in unauthorized access to critical data and partial unauthorized modification capabilities. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N with a base score of 7.1. The vulnerability is identified as CWE-284 (Improper Access Control). Oracle has published an advisory as part of its August 2026 Critical Security Patch Update but does not explicitly confirm patch availability for this specific vulnerability in the provided advisory content.

Successful exploitation can lead to unauthorized access to all Siebel CRM Administration accessible data and unauthorized update, insert, or delete operations on some of that data. This compromises confidentiality and integrity but does not affect availability. The attack requires network access via HTTP and low privilege but no user interaction.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although the provided advisory does not explicitly confirm a patch for this specific vulnerability, Oracle's general guidance is to remain on actively supported versions and apply all relevant patches without delay. Patch status for this vulnerability is not explicitly confirmed; users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest remediation information.