This vulnerability in Oracle Siebel CRM End User's Reports component permits an unauthenticated attacker with network access over HTTP to compromise the application. Successful exploitation leads to unauthorized access to critical or all data accessible through the Siebel CRM End User interface. The affected versions are from 17.0 up to and including 26.7. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update advisory, which provides patches for this and many other vulnerabilities.

An attacker exploiting this vulnerability can gain unauthorized access to sensitive and critical data within the Siebel CRM End User environment. This compromises confidentiality but does not affect integrity or availability. The vulnerability is exploitable remotely without authentication, increasing the risk of data exposure.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. It is strongly recommended that customers apply these patches promptly to mitigate the risk. Oracle advises remaining on actively supported versions and applying security updates without delay. No indication of alternative mitigations or that the issue is already mitigated without patching is provided.