This vulnerability in Oracle Siebel Apps - Financial Services enables unauthenticated remote attackers to compromise the application via HTTP. Successful exploitation can lead to unauthorized access to all accessible data within the Siebel Apps - Financial Services environment or cause a hang or frequent crash resulting in a complete denial of service. The affected versions are from 17.0 up to and including 26.7. The vulnerability is rated critical with a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H). Oracle has acknowledged this issue and included a fix in their September 2026 Critical Security Patch Update, which contains numerous patches across multiple products including Siebel Applications.

Exploitation of this vulnerability can result in unauthorized access to sensitive financial data managed by Siebel Apps - Financial Services, compromising confidentiality. Additionally, it can cause a complete denial of service by hanging or crashing the application, impacting availability. There is no impact on integrity reported. The vulnerability is remotely exploitable without authentication over the network via HTTP.

Oracle has released a Critical Security Patch Update in September 2026 that includes a fix for this vulnerability. It is strongly recommended that customers apply the available security patches promptly to mitigate this risk. Oracle advises remaining on actively supported versions and applying patches without delay. No alternative mitigations or workarounds are specified in the advisory.