This vulnerability in Siebel CRM Cloud Applications (component: Siebel Cloud Manager) affects supported versions 22.3 to 26.7. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise the application. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or full access to all accessible data within Siebel CRM Cloud Applications. The vulnerability has a CVSS 3.1 base score of 8.2, reflecting high confidentiality and integrity impacts with no impact on availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted fixes for this and other vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel CRM Cloud Applications, as well as unauthorized access to all accessible data in the application. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability may also impact additional products due to scope change.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle without delay to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches. Patch status is confirmed as available via the Oracle advisory.