This vulnerability in Oracle Siebel CRM Development's Integration - Scripting component allows an attacker with low privileges and network access over HTTP to compromise the application. Exploitation can result in unauthorized ability to cause a hang or repeated crash (complete denial of service), unauthorized update, insert, or delete operations on some accessible data, and unauthorized read access to a subset of accessible data. The affected versions are from 17.0 up to and including 26.7. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H with a base score of 7.6. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted patches for Siebel CRM Development among other products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to a complete denial of service of Siebel CRM Development by causing hangs or crashes. Additionally, attackers can gain unauthorized read access to some data and unauthorized update, insert, or delete access to certain accessible data within the application. This impacts confidentiality, integrity, and availability of the affected system.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. Patch status is confirmed by the vendor advisory.