This vulnerability in Oracle Siebel CRM Integration (component: Event Publish and Subscribe) affects versions 23.6 to 26.7. It permits an unauthenticated attacker who has access to the physical communication segment attached to the hardware running the integration to compromise the system. The compromise can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Siebel CRM Integration. The CVSS 3.1 base score is 8.1, indicating high impact on confidentiality and integrity, with no impact on availability. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update.

The vulnerability allows unauthorized attackers with physical network segment access to gain unauthorized creation, deletion, or modification rights over critical data in Siebel CRM Integration or to access all data accessible by the integration. This compromises confidentiality and integrity of the data but does not affect availability. The high CVSS score (8.1) reflects the significant risk to data security posed by this vulnerability.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly to mitigate the risk. No indication was given that the vulnerability is already mitigated or requires no action. Since this is not a cloud service, patching must be applied by customers following Oracle's advisory instructions.