This vulnerability in Oracle Siebel CRM Integration (Open Integration component) affects versions from 25.12 up to and including 26.6. It permits an unauthenticated attacker who has access to the physical communication segment connected to the hardware executing the integration to compromise the system. The attacker can gain unauthorized capabilities to create, delete, or modify critical data or access all data accessible by the integration. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating attack requires adjacent network access with low complexity, no privileges, and no user interaction, resulting in high confidentiality and integrity impact. Oracle has published this vulnerability with a high severity rating but no explicit patch information is provided in the advisory content.

An attacker with physical network segment access can exploit this vulnerability to gain unauthorized creation, deletion, or modification rights over critical or all accessible data within Siebel CRM Integration. This compromises confidentiality and integrity of the data but does not impact availability. The high CVSS score of 8.1 reflects the significant risk to data security if exploited.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Since the vulnerability requires physical access to the communication segment, limiting such access can reduce risk. No explicit vendor statement indicates that the vulnerability is already mitigated or that no action is required.