This vulnerability in Oracle Siebel Apps - Customer Order Management (versions 17.0 to 26.7) permits a low-privileged attacker with network access via HTTP to compromise the application. Exploitation requires user interaction from someone other than the attacker and can result in unauthorized creation, deletion, or modification of critical data, affecting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 8.7, indicating high severity. The scope of impact may extend beyond the Customer Order Management component to other related products. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

Exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel Apps - Customer Order Management, resulting in a significant confidentiality and integrity breach. There is no impact on availability. The vulnerability's scope change means additional Oracle products may also be impacted. The attack requires network access and user interaction from a third party.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using affected versions (17.0 through 26.7) should apply these patches without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security updates to mitigate exploitation risks.