This vulnerability in Oracle Siebel CRM Cloud Applications (component: Siebel Cloud Manager) affects versions from 22.3 up to and including 26.7. It enables an unauthenticated attacker with network access over HTTP to compromise the application, resulting in unauthorized access to critical data and the ability to modify some data (update, insert, delete). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects that the attack requires no privileges or user interaction, has low attack complexity, and impacts confidentiality and integrity significantly. Oracle’s September 2026 Critical Security Patch Update includes patches for this vulnerability along with hundreds of others across multiple products. Oracle strongly recommends applying these patches promptly to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to critical data within Siebel CRM Cloud Applications and unauthorized modification (update, insert, delete) of some accessible data. This compromises confidentiality and integrity of the affected systems. There is no reported impact on availability. The vulnerability is exploitable remotely without authentication, increasing its risk.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Siebel CRM Cloud Applications versions 22.3 through 26.7 without delay. Oracle strongly advises remaining on actively supported versions and promptly applying security updates to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.