This vulnerability in Oracle Siebel CRM Deployment allows an unauthenticated remote attacker to compromise the system via HTTP network access. Successful exploitation results in unauthorized access to critical and all accessible data, as well as unauthorized modification capabilities (update, insert, delete) on some data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality impact and low integrity impact, and no availability impact. The affected versions are from 17.0 up to and including 26.7. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability, emphasizing the importance of applying the patch to prevent exploitation.

An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data or full access to all accessible data in the Siebel CRM Deployment. Additionally, the attacker can perform unauthorized data modifications including updates, inserts, or deletions on some data. This compromises confidentiality and integrity of the affected system’s data, potentially leading to data breaches or data tampering.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Siebel CRM Deployment versions 17.0 through 26.7 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this vulnerability. Patch status is confirmed as available via the official Oracle advisory.