This vulnerability affects the Server Infrastructure component of Oracle Siebel CRM Deployment versions 17.0 through 26.7. It allows an unauthenticated attacker with network access via HTTP to compromise the deployment, leading to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by the deployment. The vulnerability is rated with a CVSS 3.1 score of 7.4, reflecting high impact on confidentiality and integrity. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes including this issue. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or unauthorized access to all data accessible within the Siebel CRM Deployment. This compromises confidentiality and integrity of the system's data. There is no reported impact on availability. The vulnerability requires network access via HTTP but no authentication, though it is considered difficult to exploit.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.