This vulnerability in Oracle Siebel CRM Integration (Open Integration component) affects versions from 25.12 up to and including 26.6. It is difficult to exploit but allows a low privileged attacker with network access over HTTP to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 score of 8.5 with high impact on confidentiality, integrity, and availability, and includes a scope change affecting additional Oracle products. Oracle's August 2026 Critical Security Patch Update advisory addresses this vulnerability among 943 patches. Customers are strongly advised to apply the official patches promptly to mitigate risk.

Successful exploitation of this vulnerability can lead to complete compromise of the Siebel CRM Integration product, impacting confidentiality, integrity, and availability. Due to scope change, additional Oracle products may also be affected by attacks leveraging this vulnerability. The vulnerability requires network access via HTTP and low privileges but is rated difficult to exploit.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability. Customers should apply the official patches from Oracle without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.