This vulnerability in Oracle Siebel CRM Integration (Open Integration component) affects versions from 25.12 up to and including 26.6. It allows a low privileged attacker with network access over HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among 943 patches released, urging customers to apply patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible via Siebel CRM Integration. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, attacks may also significantly impact other Oracle products integrated with Siebel CRM Integration.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the relevant security patches promptly. No specific patch links were provided in the input data; users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions. Remaining on actively supported versions and timely patching are critical to mitigation.