This vulnerability in Oracle Siebel Apps - Customer Order Management (versions 17.0 to 26.7) permits a low privileged attacker with network access via HTTP to compromise the application. Exploitation requires user interaction from a third party and can result in unauthorized creation, deletion, or modification of critical data within the affected product. The vulnerability has a CVSS 3.1 base score of 8.7, reflecting high confidentiality and integrity impacts with no availability impact. The scope of the vulnerability extends beyond the initial product, potentially affecting other Oracle products. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability and strongly recommends applying patches promptly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Siebel Apps - Customer Order Management, as well as unauthorized access to critical or all accessible data. The vulnerability affects confidentiality and integrity with a high severity score (CVSS 8.7). There is no reported impact on availability. The scope change indicates that additional Oracle products may also be impacted by this vulnerability.

Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches without delay to mitigate the risk. The vendor advisory does not indicate that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, remediation depends on customer patching. Patch status is confirmed by the vendor advisory. Refer to Oracle's official advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions.