This vulnerability in Oracle Siebel CRM Integration (versions >=25.12 <=26.6) permits a high privileged attacker with network access over HTTP to compromise the system. The attack can result in unauthorized modification of critical data and cause repeated hangs or crashes, leading to denial of service. The vulnerability affects the Open Integration component and may have broader impact on other Oracle products due to scope change. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H, indicating network attack vector, high attack complexity, high privileges required, no user interaction, scope change, no confidentiality impact, but high integrity and availability impacts.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within Siebel CRM Integration and can cause denial of service by hanging or crashing the service. The scope change means that other Oracle products integrated with Siebel CRM Integration may also be significantly impacted. The CVSS score of 7.7 indicates a high impact on integrity and availability, but no confidentiality loss.

Oracle has released security patches as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to affected versions (>=25.12 <=26.6). No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, remediation depends on customer patching. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.