This vulnerability in Oracle Siebel CRM End User's Open UI component affects versions from 17.0 up to and including 26.6. It permits a low privileged attacker with network access over HTTPS to compromise the product, contingent on user interaction by a third party. The scope of impact extends beyond the Siebel CRM End User to additional products. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Siebel CRM End User. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects network attack vector, high attack complexity, low privileges required, required user interaction, scope change, and high confidentiality and integrity impacts.

An attacker exploiting this vulnerability can gain unauthorized ability to create, delete, or modify critical data within Siebel CRM End User and potentially other related products due to scope change. This compromises confidentiality and integrity of sensitive business data. The attack requires network access via HTTPS and user interaction from a person other than the attacker, limiting ease of exploitation. There is no impact on availability.

Oracle has released this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to affected versions of Siebel CRM End User (17.0 through 26.6). Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by Oracle's advisory; therefore, remediation is available through official patches.