This vulnerability in Siebel Apps - Self Service allows an unauthenticated remote attacker to exploit the system over HTTP, contingent on user interaction by someone other than the attacker. The vulnerability affects versions 17.0 through 26.6 inclusive. Exploitation can result in unauthorized creation, deletion, or modification of critical data, with a scope change potentially affecting other Oracle products. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and high confidentiality and integrity impacts. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability but does not explicitly state patch availability for this specific CVE in the provided content.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel Apps - Self Service. The vulnerability also has a scope change, meaning it may significantly impact additional Oracle products beyond Siebel Apps - Self Service. The confidentiality and integrity of data are highly impacted, but availability is not affected. The attack requires user interaction from a person other than the attacker and can be performed without authentication over the network via HTTP.

Oracle has published a Critical Security Patch Update advisory that addresses multiple vulnerabilities including this one. Customers are strongly advised to remain on actively supported versions and apply Oracle security patches without delay. The advisory does not explicitly confirm patch availability for CVE-2026-70855 in the provided content. Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for current remediation guidance and patch availability.