This vulnerability in Oracle Siebel CRM Development's Configuration Tools component affects versions 17.0 to 26.7. It is exploitable by a low privileged attacker with network access through SQL, potentially allowing full compromise of the Siebel CRM Development environment. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 others across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete takeover of the Siebel CRM Development environment, impacting confidentiality, integrity, and availability of the system. The vulnerability requires network access and low privileges but has high attack complexity. No known exploits in the wild have been reported yet. The impact is rated high based on CVSS 3.1 scoring.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.