This vulnerability in Oracle Siebel CRM Integration enables a low privileged attacker with network access via SOAP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data within Siebel CRM Integration. Additionally, attackers may gain unauthorized capabilities to update, insert, or delete some of the accessible data. The vulnerability affects versions from 17.0 up to and including 26.7. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact.

Exploitation can result in unauthorized access to sensitive and critical data within Siebel CRM Integration, potentially compromising confidentiality. It also allows unauthorized modification (update, insert, delete) of some data, impacting data integrity. There is no reported impact on availability. The vulnerability is exploitable remotely over the network via SOAP by an attacker with low privileges.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. The affected versions are 17.0 through 26.7. No indication of alternative mitigations or that no action is required is provided. Patch status is confirmed by the vendor advisory.