This vulnerability affects the Server Infrastructure component of Oracle Siebel CRM Deployment versions 17.0 through 26.7. It is easily exploitable by unauthenticated attackers over the network via HTTP, enabling unauthorized access and modification of critical data within the Siebel CRM Deployment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's September 2026 Critical Security Patch Update includes patches that address this vulnerability. Customers are strongly advised to apply these patches promptly to mitigate risk.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through the Siebel CRM Deployment. This compromises confidentiality and integrity of the system's data, potentially leading to significant business impact. There is no direct impact on availability reported.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.