This vulnerability in Siebel CRM Cloud Applications allows an attacker with low privileges and physical network segment access to compromise the application. The attack surface includes unauthorized access to sensitive data, partial data modification, and partial denial of service conditions. The vulnerability affects versions from 22.3 up to and including 26.7. Oracle has addressed this issue in their September 2026 Critical Security Patch Update, which contains numerous security patches across Oracle products. Customers are strongly advised to apply the available patches promptly to mitigate risk.

Successful exploitation can result in unauthorized access to critical data within Siebel CRM Cloud Applications, unauthorized ability to update, insert, or delete some accessible data, and cause a partial denial of service. The vulnerability also has a scope change impact, potentially affecting additional products beyond Siebel CRM Cloud Applications. The CVSS score of 8.2 reflects high confidentiality impact, moderate integrity impact, and moderate availability impact.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches. No indication was given that the vulnerability is already mitigated or requires no action; therefore, patching is the primary mitigation.