This vulnerability in Oracle Siebel CRM Deployment (Cloud Gateway component) affects versions 17.0 to 26.7. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the deployment. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or unauthorized access to all data accessible via the deployment. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle’s September 2026 Critical Security Patch Update includes patches for this vulnerability.

The vulnerability enables unauthorized creation, deletion, or modification of critical data or unauthorized access to all data accessible through the Siebel CRM Deployment. This could compromise data confidentiality and integrity but does not affect availability. The attack requires network access via HTTP and low privileges but is difficult to exploit due to high attack complexity.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to remediate the issue. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No vendor advisory states that no action is required or that the issue is already mitigated without patching.