This vulnerability in Oracle Siebel CRM End User's Open UI component affects versions 17.0 through 26.7. It enables a low privileged attacker with network access via HTTP to compromise the application, resulting in unauthorized access to critical data or complete access to all data accessible by the Siebel CRM End User. Additionally, the attacker can perform unauthorized modifications such as update, insert, or delete on some of the accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update advisory, which contains numerous patches across multiple products including Siebel CRM. The advisory strongly recommends applying patches promptly. However, the specific patch for this vulnerability is not explicitly detailed in the provided advisory content.

Successful exploitation can lead to unauthorized access to critical and all accessible data within Siebel CRM End User, as well as unauthorized data modification capabilities (update, insert, delete) on some data. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability reported.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the relevant patches from this update promptly to remediate the vulnerability. The vendor advisory does not indicate that the vulnerability is already mitigated or that no action is required. Patch status is not explicitly confirmed for this specific vulnerability in the advisory, so customers should consult the Oracle Critical Security Patch Update documentation for detailed patch availability and installation instructions for Siebel CRM End User versions 17.0 through 26.7.