This vulnerability in Oracle Siebel CRM Deployment allows an unauthenticated remote attacker to exploit the system via HTTP network access. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the Siebel CRM Deployment. The affected versions are from 17.0 up to and including 26.7. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, causing high confidentiality and integrity impacts.

An attacker exploiting this vulnerability can gain unauthorized access to critical data within the Siebel CRM Deployment, including the ability to create, delete, or modify data without authentication. This compromises the confidentiality and integrity of the system's data, potentially affecting business operations and data trustworthiness. There is no direct impact on availability reported.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions (17.0 through 26.7) to remediate this issue. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are indicated.