This vulnerability in Oracle Siebel CRM Cloud Applications (component: Siebel Cloud Manager) affects versions from 22.3 up to and including 26.7. It is exploitable remotely over HTTP by unauthenticated attackers, allowing unauthorized access to critical or all accessible data within the affected cloud applications. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products including Siebel Applications. The vendor strongly recommends applying the available patches promptly.

Successful exploitation results in unauthorized access to critical or complete data within Siebel CRM Cloud Applications. This compromises confidentiality but does not affect integrity or availability. The vulnerability can be exploited remotely without authentication or user interaction, increasing the risk of data exposure.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Siebel CRM Cloud Applications versions 22.3 through 26.7 without delay. Oracle strongly recommends staying on actively-supported versions and promptly applying security updates to mitigate this vulnerability. No vendor advisory states that no action is required or that the issue is already mitigated without patching.