This vulnerability in Oracle Siebel CRM Integration (component: Open Integration) affects supported versions from 25.12 up to and including 26.6. It permits a low privileged attacker with network access over HTTP to compromise the product, potentially resulting in complete takeover. The vulnerability's scope extends beyond Siebel CRM Integration, potentially affecting other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impacts on confidentiality, integrity, and availability. Oracle has published a Critical Security Patch Update advisory for August 2026 addressing this and many other vulnerabilities but does not explicitly confirm patch availability for this CVE in the provided content.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Siebel CRM Integration, leading to complete takeover of the product. The vulnerability also has a scope change, meaning it can significantly impact additional Oracle products beyond Siebel CRM Integration. The CVSS score of 9.9 indicates critical impact on confidentiality, integrity, and availability.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly and remain on actively supported versions. Since the product is not a cloud service, patching is the recommended remediation. Patch status is confirmed by the vendor advisory recommending application of the CSPU. No indication of 'no action required' or 'already mitigated' is present.