This vulnerability in Oracle Siebel CRM Integration (Open Integration component) affects versions from 25.12 up to and including 26.6. It is easily exploitable by an attacker with low privileges and network access over HTTP. Successful exploitation can result in unauthorized access to critical data and unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 score of 8.5 with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s advisory for the August 2026 Critical Security Patch Update includes this vulnerability among 943 patches and urges customers to apply patches without delay.

Exploitation of this vulnerability can lead to unauthorized access to all data accessible via Siebel CRM Integration, including critical data. Attackers may also perform unauthorized update, insert, or delete operations on some of the accessible data. The scope of impact may extend beyond Siebel CRM Integration to additional Oracle products. The CVSS score of 8.5 reflects high confidentiality impact and partial integrity impact, with no availability impact.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Since the product is not a cloud service, remediation depends on customers applying the patches. No indication of 'no action required' or 'already mitigated' was provided, so patching is the recommended mitigation. Check Oracle’s official advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions.