This vulnerability in Oracle Siebel Apps - Life Sciences (versions 17.0 to 26.7) permits a low privileged attacker who has logon access to the infrastructure hosting the application to compromise it. Exploitation requires human interaction from someone other than the attacker. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) reflects that the attack vector is local, with low attack complexity, low privileges required, and user interaction needed. Successful exploitation results in high impact on confidentiality, integrity, and availability, potentially allowing full takeover of the Siebel Apps - Life Sciences environment. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches across products, including Siebel Apps - Life Sciences. The vendor strongly recommends applying security patches promptly to mitigate this and other vulnerabilities.

The vulnerability allows an attacker with low privileges and logon access to the infrastructure to compromise the Siebel Apps - Life Sciences application. It requires human interaction from a user other than the attacker. Successful exploitation can lead to complete takeover of the application, impacting confidentiality, integrity, and availability at a high level.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches for Siebel Apps - Life Sciences versions 17.0 through 26.7 without delay. Staying on actively supported versions and promptly applying Oracle patches is critical to mitigating this vulnerability. No alternative or temporary mitigations are provided by the vendor advisory.