This vulnerability in Oracle Siebel CRM Cloud Applications (component: Siebel Cloud Manager) affects versions 22.3 through 26.7. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can result in complete compromise of the Siebel CRM Cloud Applications, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with a base score of 8.8. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes 673 security patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Siebel CRM Cloud Applications, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized data access, data manipulation, and service disruption.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Siebel CRM Cloud Applications versions 22.3 through 26.7 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate exploitation risks.