This vulnerability in Oracle Siebel CRM Deployment allows a low privileged attacker with network access via HTTP to compromise the deployment. Successful exploitation can lead to unauthorized access to critical or all accessible data and cause a partial denial of service. The affected versions are from 17.0 up to and including 26.7. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. Oracle strongly recommends applying these patches promptly.

Exploitation of this vulnerability can result in unauthorized access to sensitive or all accessible data within the Siebel CRM Deployment, compromising confidentiality. It can also cause a partial denial of service, impacting availability. There is no reported impact on integrity. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the provided patches without delay to remediate this issue. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches to prevent exploitation. No additional vendor-advised mitigations or workarounds are specified.