This vulnerability affects Oracle Siebel CRM Deployment versions 17.0 to 26.7. It is an easily exploitable flaw that permits a high privileged attacker with network access over HTTP to compromise the Siebel CRM Deployment server infrastructure. The vulnerability has a CVSS 3.1 score of 9.1 with network attack vector, low attack complexity, high privileges required, no user interaction, and scope change, resulting in high confidentiality, integrity, and availability impacts. Successful exploitation can lead to complete takeover of the Siebel CRM Deployment environment. Oracle’s advisory confirms the vulnerability and includes it in their September 2026 Critical Security Patch Update, which contains targeted patches for this and many other vulnerabilities. The vendor strongly recommends applying these patches promptly.

Successful exploitation allows an attacker with high privileges and network access via HTTP to fully compromise the Siebel CRM Deployment. This includes takeover of the deployment environment and potentially impacts additional Oracle products due to scope change. The vulnerability affects confidentiality, integrity, and availability at a high level, as reflected by the CVSS 3.1 score of 9.1.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the issue. Oracle strongly recommends remaining on actively supported versions and promptly applying all security updates to prevent exploitation. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.