This vulnerability in Oracle Siebel CRM End User (Open UI) affects supported versions 17.0 through 26.7. It is easily exploitable by unauthenticated attackers over HTTP, enabling unauthorized access to critical and all accessible data, unauthorized update, insert, or delete operations on some data, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with lower integrity and availability impacts. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle strongly recommends applying these patches without delay to mitigate exploitation risks.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Siebel CRM End User, unauthorized modification (update, insert, delete) of some data, and partial denial of service conditions. The vulnerability affects confidentiality, integrity, and availability, with the highest impact on confidentiality. No known active exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers should apply the official patches promptly to remediate the issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.