This vulnerability in Oracle Siebel Apps - Life Sciences (eDetailing component) affects versions 17.0 to 26.7. It is exploitable remotely over HTTP without authentication but requires user interaction from a third party. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impact with no availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides targeted security fixes. Oracle strongly recommends applying available patches promptly to mitigate this and other vulnerabilities.

An attacker with network access via HTTP can exploit this vulnerability without authentication but requires a user to interact with the attack. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Siebel Apps - Life Sciences, impacting confidentiality and integrity of sensitive information.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the issue. Oracle strongly recommends remaining on actively-supported versions and promptly applying all security updates. Patch status is confirmed as available via the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.